Add pyproject.toml

Add script and tests for linked issues, removing method from the release notes script
Add release notes processing script and unit tests
2026-05-09 13:29:18 -05:00 · 2025-03-03 16:57:12 +00:00 · 2025-03-03 16:52:43 +00:00 · 2025-03-03 15:44:11 +00:00 · 2025-03-03 15:43:27 +00:00
3397 changed files with 232374 additions and 254055 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -5,7 +5,7 @@
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners

 # Default file owners.
-* @bitwarden/team-android @brian-livefront @david-livefront
+* @bitwarden/team-android @brian-livefront @david-livefront @dseverns-livefront @ahaisting-livefront @phil-livefront

 # Actions and workflow changes.
 .github/ @bitwarden/dept-development-mobile
@@ -48,9 +48,3 @@
 # app/src/main/java/com/x8bit/bitwarden/ui/vault  @bitwarden/team-vault-dev
 # app/src/test/java/com/x8bit/bitwarden/data/vault @bitwarden/team-vault-dev
 # app/src/test/java/com/x8bit/bitwarden/ui/vault  @bitwarden/team-vault-dev
-
-# Docker-related files
-**/Dockerfile @bitwarden/team-appsec @bitwarden/dept-bre
-**/*.dockerignore @bitwarden/team-appsec @bitwarden/dept-bre
-**/entrypoint.sh @bitwarden/team-appsec @bitwarden/dept-bre
-**/docker-compose.yml @bitwarden/team-appsec @bitwarden/dept-bre
--- a/.github/ISSUE_TEMPLATE/bug-passkey.yml
+++ b/.github/ISSUE_TEMPLATE/bug-passkey.yml
@@ -1,64 +0,0 @@
-name: Passkey Bug Report
-description: File a Passkey / FIDO2 related bug report
-labels: [ "app:password-manager", "bug-passkey" ]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this Passkey-related bug report!
-
-        Please provide as much detail as possible to help us investigate the issue.
-
-  - type: dropdown
-    id: origin
-    attributes:
-      label: Origin
-      description: Are you using a web browser or a native application?
-      options:
-        - Web (Browser)
-        - Native Application (non-browser app)
-    validations:
-      required: true
-
-  - type: input
-    id: rp-id
-    attributes:
-      label: Web URL or App name
-      description: The website domain or app name you were trying to use the Passkey with
-      placeholder: "e.g. example.com or ExampleApp"
-    validations:
-      required: true
-
-  - type: checkboxes
-    id: operation-type
-    attributes:
-      label: Passkey Action
-      description: What passkey related action(s) were you trying to perform?
-      options:
-        - label: Creating new passkey (Registration)
-        - label: Signing in (Authentication)
-    validations:
-      required: true
-
-  - type: textarea
-    id: build-info
-    attributes:
-      label: Build Information
-      description: Please retrieve the build information from the About screen by tapping the Version number field
-    validations:
-      required: true
-
-  - type: textarea
-    id: additional-info
-    attributes:
-      label: Additional Information
-      description: Any additional context, steps to reproduce, error messages, or relevant information about the issue
-
-  - type: checkboxes
-    id: issue-tracking-info
-    attributes:
-      label: Issue Tracking Info
-      description: |
-        Issue tracking information
-      options:
-        - label: I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
--- a/.github/actions/log-inputs/action.yml
+++ b/.github/actions/log-inputs/action.yml
@@ -1,20 +0,0 @@
-name: 'Log Inputs to Job Summary'
-description: 'Log workflow inputs to the GitHub Actions job summary'
-
-inputs:
-  inputs:
-    description: 'Workflow inputs as JSON'
-    required: true
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Log inputs to job summary
-      shell: bash
-      run: |
-        echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo '```json' >> $GITHUB_STEP_SUMMARY
-        echo '${{ inputs.inputs }}' >> $GITHUB_STEP_SUMMARY
-        echo '```' >> $GITHUB_STEP_SUMMARY
-        echo "</details>" >> $GITHUB_STEP_SUMMARY
--- a/.github/actions/setup-android-build/action.yml
+++ b/.github/actions/setup-android-build/action.yml
@@ -1,49 +0,0 @@
-name: 'Setup Android Build'
-description: 'Setup Android build environment with Gradle, Ruby, and Fastlane'
-inputs:
-  java-version:
-    description: 'Java version to use'
-    required: false
-    default: '21'
-runs:
-  using: 'composite'
-  steps:
-    - name: Validate Gradle wrapper
-      uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-
-    - name: Cache Gradle files
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      with:
-        path: |
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-        key: ${{ runner.os }}-gradle-v2-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-v2-
-
-    - name: Cache build output
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      with:
-        path: |
-          ${{ github.workspace }}/build-cache
-        key: ${{ runner.os }}-build-cache-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-build-
-
-    - name: Configure Ruby
-      uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
-      with:
-        bundler-cache: true
-
-    - name: Configure JDK
-      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-      with:
-        distribution: "temurin"
-        java-version: ${{ inputs.java-version }}
-
-    - name: Install Fastlane
-      shell: bash
-      run: |
-        gem install bundler:2.2.27
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,59 +1,33 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "github>bitwarden/renovate-config"
-  ],
-  "enabledManagers": [
-    "github-actions",
-    "gradle",
-    "bundler"
-  ],
+  "extends": ["github>bitwarden/renovate-config"],
+  "enabledManagers": ["github-actions", "gradle", "bundler"],
  "packageRules": [
    {
      "groupName": "gh minor",
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ]
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "groupName": "gradle minor",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchManagers": [
-        "gradle"
-      ],
-      "excludePackageNames": [
-        "com.github.bumptech.glide:compose"
-      ]
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": ["gradle"]
    },
    {
      "groupName": "kotlin",
      "description": "Kotlin and Compose dependencies that must be updated together to maintain compatibility.",
-      "matchManagers": [
-        "gradle"
+      "matchPackagePatterns": [
+        "androidx.compose:compose-bom",
+        "androidx.lifecycle:*",
+        "org.jetbrains.kotlin.*",
+        "com.google.devtools.ksp"
      ],
-      "matchPackageNames": [
-        "/androidx.compose:compose-bom/",
-        "/androidx.lifecycle:*/",
-        "/org.jetbrains.kotlin.*/",
-        "/com.google.devtools.ksp/"
-      ]
+      "matchManagers": ["gradle"]
    },
    {
      "groupName": "bundler minor",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchManagers": [
-        "bundler"
-      ]
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": ["bundler"]
    }
  ]
 }
--- a/.github/scripts/jira-get-release-notes/README.md
+++ b/.github/scripts/jira-get-release-notes/README.md
@@ -1,133 +0,0 @@
-# Get Release Notes from Jira script
-
-Fetches release notes from Jira issues.
-
-## Prerequisites
-
- Python dev environment - use [uv](https://github.com/astral-sh/uv)
- Jira API token. Generate one at: https://id.atlassian.com/manage-profile/security/api-tokens
- Install dependencies:
-
-```bash
-uv pip install -r pyproject.toml
-```
-
-## Usage
-
-```bash
-./jira_release_notes.py RELEASE-1762 example@example.com T0k3n123
-```
-
-# Output Format
-
-The script retrieves the content from a custom field and handles two types of Jira release notes formats:
-
-1. Bullet Points:
-```
-• Point 1
-• Point 2
-• Point 3
-```
-
-2. Single Line:
-```
-Single line of release notes text
-```
-
-## Jira JSON format example
-
-### Single line
-
-```json
-...
-"customfield_10335": {
-    "type": "doc",
-    "version": 1,
-    "content": [
-        {
-            "type": "paragraph",
-            "content": [
-                {
-                    "type": "text",
-                    "text": "Single line release notes"
-                }
-            ]
-        }
-    ]
-},
-...
-```
-
-### Bullet points
-
-```json
-...
-"customfield_10335": {
-    "type": "doc",
-    "version": 1,
-    "content": [
-        {
-            "type": "bulletList",
-            "content": [
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 1"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 2"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 3"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 4"
-                                }
-                            ]
-                        }
-                    ]
-                }
-            ]
-        }
-    ]
-},
-...
-```
--- a/.github/scripts/jira-get-release-notes/jira_release_notes.py
+++ b/.github/scripts/jira-get-release-notes/jira_release_notes.py
@@ -1,70 +0,0 @@
-#!/usr/bin/env python3
-
-import sys
-import base64
-import json
-import requests
-
-def extract_text_from_content(content):
-    if isinstance(content, list):
-        texts = [extract_text_from_content(item) for item in content]
-        return '\n'.join(text for text in texts if text.strip())
-
-    if isinstance(content, dict):
-        if content.get('type') == 'text':
-            return content.get('text', '')
-        elif content.get('type') == 'paragraph':
-            return extract_text_from_content(content.get('content', []))
-        elif content.get('type') == 'bulletList':
-            return extract_text_from_content(content.get('content', []))
-        elif content.get('type') == 'listItem':
-            item_text = extract_text_from_content(content.get('content', []))
-            return f"* {item_text.strip()}"
-
-    return ''
-
-def parse_release_notes(response_json):
-    try:
-        fields = response_json.get('fields', {})
-        release_notes_field = fields.get('customfield_10335', {})
-
-        if not release_notes_field or not release_notes_field.get('content'):
-            return ''
-
-        release_notes = extract_text_from_content(release_notes_field.get('content', []))
-        return release_notes
-
-    except Exception as e:
-        print(f"Error parsing release notes: {str(e)}", file=sys.stderr)
-        return ''
-
-def main():
-    if len(sys.argv) != 4:
-        print(f"Usage: {sys.argv[0]} <issue_id> <jira_email> <jira_api_token>")
-        sys.exit(1)
-
-    jira_issue_id = sys.argv[1]
-    jira_email = sys.argv[2]
-    jira_api_token = sys.argv[3]
-    jira_base_url = "https://bitwarden.atlassian.net"
-
-    auth = base64.b64encode(f"{jira_email}:{jira_api_token}".encode()).decode()
-    headers = {
-        "Authorization": f"Basic {auth}",
-        "Content-Type": "application/json"
-    }
-
-    response = requests.get(
-        f"{jira_base_url}/rest/api/3/issue/{jira_issue_id}",
-        headers=headers
-    )
-
-    if response.status_code != 200:
-        print(f"Error fetching Jira issue: {response.status_code}", file=sys.stderr)
-        sys.exit(1)
-
-    release_notes = parse_release_notes(response.json())
-    print(release_notes)
-
-if __name__ == "__main__":
-    main()
--- a/.github/scripts/jira-get-release-notes/pyproject.toml
+++ b/.github/scripts/jira-get-release-notes/pyproject.toml
@@ -1,9 +0,0 @@
-[project]
-name = "jira-get-release-notes"
-version = "0.1.0"
-description = "Add your description here"
-readme = "README.md"
-requires-python = ">=3.12"
-dependencies = [
-    "requests>=2.32.3",
-]
--- a/.github/scripts/jira-get-release-notes/uv.lock
+++ b/.github/scripts/jira-get-release-notes/uv.lock
@@ -1,91 +0,0 @@
-version = 1
-revision = 2
-requires-python = ">=3.12"
-
-[[package]]
-name = "certifi"
-version = "2025.4.26"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" },
-]
-
-[[package]]
-name = "charset-normalizer"
-version = "3.4.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload-time = "2025-05-02T08:34:42.01Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload-time = "2025-05-02T08:32:33.712Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload-time = "2025-05-02T08:32:35.768Z" },
-    { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload-time = "2025-05-02T08:32:37.284Z" },
-    { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload-time = "2025-05-02T08:32:38.803Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload-time = "2025-05-02T08:32:40.251Z" },
-    { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload-time = "2025-05-02T08:32:41.705Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload-time = "2025-05-02T08:32:43.709Z" },
-    { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload-time = "2025-05-02T08:32:46.197Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload-time = "2025-05-02T08:32:48.105Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload-time = "2025-05-02T08:32:49.719Z" },
-    { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload-time = "2025-05-02T08:32:51.404Z" },
-    { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload-time = "2025-05-02T08:32:53.079Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload-time = "2025-05-02T08:32:54.573Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload-time = "2025-05-02T08:32:56.363Z" },
-    { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload-time = "2025-05-02T08:32:58.551Z" },
-    { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload-time = "2025-05-02T08:33:00.342Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload-time = "2025-05-02T08:33:02.081Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload-time = "2025-05-02T08:33:04.063Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload-time = "2025-05-02T08:33:06.418Z" },
-    { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload-time = "2025-05-02T08:33:08.183Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload-time = "2025-05-02T08:33:09.986Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload-time = "2025-05-02T08:33:11.814Z" },
-    { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload-time = "2025-05-02T08:33:13.707Z" },
-    { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload-time = "2025-05-02T08:33:15.458Z" },
-    { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload-time = "2025-05-02T08:33:17.06Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload-time = "2025-05-02T08:33:18.753Z" },
-    { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload-time = "2025-05-02T08:34:40.053Z" },
-]
-
-[[package]]
-name = "jira-get-release-notes"
-version = "0.1.0"
-source = { virtual = "." }
-dependencies = [
-    { name = "requests" },
-]
-
-[package.metadata]
-requires-dist = [{ name = "requests", specifier = ">=2.32.3" }]
-
-[[package]]
-name = "idna"
-version = "3.10"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
-]
-
-[[package]]
-name = "requests"
-version = "2.32.3"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "certifi" },
-    { name = "charset-normalizer" },
-    { name = "idna" },
-    { name = "urllib3" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload-time = "2024-05-29T15:37:47.027Z" },
-]
-
-[[package]]
-name = "urllib3"
-version = "2.4.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/8a/78/16493d9c386d8e60e442a35feac5e00f0913c0f4b7c217c11e8ec2ff53e0/urllib3-2.4.0.tar.gz", hash = "sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466", size = 390672, upload-time = "2025-04-10T15:23:39.232Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/6b/11/cc635220681e93a0183390e26485430ca2c7b5f9d33b15c74c2861cb8091/urllib3-2.4.0-py3-none-any.whl", hash = "sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813", size = 128680, upload-time = "2025-04-10T15:23:37.377Z" },
-]
--- a/.github/scripts/release-notes/linked_issues.py
+++ b/.github/scripts/release-notes/linked_issues.py
@@ -0,0 +1,64 @@
+import sys
+import subprocess
+from typing import List
+
+def create_linked_issue_comment(repo_owner: str, repo_name: str, release_name: str, release_link: str, pr_numbers: List[int]) -> str:
+    if len(pr_numbers) == 0:
+        return ""
+
+    pr_links = [f"* https://github.com/{repo_owner}/{repo_name}/pull/{pr_number}" for pr_number in pr_numbers]
+
+    return f":shipit: Pull Request(s) linked to this issue released in [{release_name}]({release_link}):\n\n"+ "\n".join(pr_links)
+
+def comment_linked_issues_in_pr(owner: str, repo: str, pr_number: int) -> None:
+    """Use GitHub CLI to comment all issues linked to a PR.
+    """
+
+
+    linked_issues = get_linked_issues(owner, repo, pr_number)
+    for issue_number in linked_issues:
+        comment_github_issue(owner, repo, issue_number, comment)
+
+def comment_github_issue(owner: str, repo: str, issue_number: int, comment: str) -> None:
+    """Use GitHub CLI to comment on an issue.
+    """
+    subprocess.run([
+        'gh', 'issue', 'comment', str(issue_number), '--body', comment, '--repo', f'{owner}/{repo}'
+    ], check=True)
+
+def get_linked_issues(owner: str, repo: str, pr_number: int) -> List[int]:
+    """Use GitHub CLI to retrieve linked issue numbers for a PR.
+    """
+
+    query = """
+    query ($owner: String!, $repo: String!, $pr: Int!) {
+        repository(owner: $owner, name: $repo) {
+            pullRequest(number: $pr) {
+                closingIssuesReferences(first: 100) {
+                    nodes {
+                        number
+                    }
+                }
+            }
+        }
+    }
+    """
+
+    try:
+        result = subprocess.run([
+            'gh', 'api', 'graphql',
+            '-F', f'owner={owner}',
+            '-F', f'repo={repo}',
+            '-F', f'pr={pr_number}',
+            '-f', f'query={query}',
+            '--jq', '.data.repository.pullRequest.closingIssuesReferences.nodes[].number'
+        ], capture_output=True, text=True, check=True)
+
+        # Split output into lines and convert to integers
+        if result.stdout.strip():
+            return [int(num) for num in result.stdout.strip().split('\n')]
+        return []
+
+    except subprocess.CalledProcessError:
+        print(f"Error fetching linked issues for PR #{pr_number}")
+        return []
--- a/.github/scripts/release-notes/process_release_notes.py
+++ b/.github/scripts/release-notes/process_release_notes.py
@@ -0,0 +1,112 @@
+import re
+import sys
+import subprocess
+import json
+from typing import List, Tuple
+
+def extract_jira_tickets(line: str) -> List[str]:
+    # Find all Jira tickets in format ABC-123 (with any prefix/suffix)
+    return re.findall(r'[A-Z]+-\d+', line)
+
+def extract_pr_numbers(line: str) -> List[str]:
+    # Match PR numbers from GitHub format (#123)
+    return re.findall(r'#(\d+)', line)
+
+def process_line(line: str) -> str:
+    """Process a single line from release notes by removing Jira tickets, conventional commit prefixes and other common patterns.
+
+    Args:
+        line: A single line from release notes
+
+    Returns:
+        Processed line with tickets and prefixes removed
+
+    Example:
+        >>> process_line("[ABC-123] feat(ui): Add new button")
+        "Add new button"
+    """
+    original = line
+
+    # Remove Jira ticket patterns:
+    # line = re.sub(r'\[[A-Z]+-\d+\]', '', line) # [ABC-123] -> ""
+    # line = re.sub(r'[A-Z]+-\d+:\s', '', line) # ABC-123: -> ""
+    # line = re.sub(r'[A-Z]+-\d+\s-\s', '', line) # ABC-123 - -> ""
+
+    # Remove keywords and their variations
+    patterns = [
+        r'BACKPORT',              # BACKPORT -> ""
+        r'[deps]:',               # [deps]: -> ""
+        r'feat(?:\([^)]*\))?:',   # feat: or feat(ui): -> ""
+        r'bug(?:\([^)]*\))?:',    # bug: or bug(core): -> ""
+        r'ci(?:\([^)]*\))?:'      # ci: or ci(workflow): -> ""
+    ]
+    for pattern in patterns:
+        line = re.sub(pattern, '', line)
+
+    cleaned = line.strip()
+    if cleaned != original.strip():
+        print(f"Processed: {original.strip()} -> {cleaned}")
+    return cleaned
+
+def process_file(input_file: str) -> Tuple[List[str], List[str], List[str]]:
+    jira_tickets: List[str] = []
+    pr_numbers: List[str] = []
+    processed_lines: List[str] = []
+
+    print("Processing file: ", input_file)
+
+    with open(input_file, 'r') as f:
+        for line in f:
+            line = line.strip()
+            should_process = line and not line.endswith(':')
+
+            if should_process:
+                tickets = extract_jira_tickets(line)
+                jira_tickets.extend(tickets)
+
+                prs = extract_pr_numbers(line)
+                pr_numbers.extend(prs)
+                processed_lines.append(process_line(line))
+            else:
+                processed_lines.append(line)
+
+
+    # Remove duplicates while preserving order
+    jira_tickets = list(dict.fromkeys(jira_tickets))
+    pr_numbers = list(dict.fromkeys(pr_numbers))
+
+    print("Jira tickets:", ",".join(jira_tickets))
+    print("PR numbers:", ",".join(pr_numbers))
+    print("Finished processing file: ", input_file)
+    return jira_tickets, pr_numbers, processed_lines
+
+def save_results(jira_tickets: List[str], pr_numbers: List[str], processed_lines: List[str],
+                jira_file: str = 'jira_tickets.txt',
+                pr_file: str = 'pr_numbers.txt',
+                processed_file: str = 'processed_notes.txt') -> None:
+    with open(jira_file, 'w') as f:
+        f.write('\n'.join(jira_tickets))
+
+    with open(pr_file, 'w') as f:
+        f.write('\n'.join(pr_numbers))
+
+    with open(processed_file, 'w') as f:
+        f.write('\n'.join(processed_lines))
+
+if __name__ == '__main__':
+    input_file = 'release_notes.txt'
+    jira_file = 'jira_tickets.txt'
+    pr_file = 'pr_numbers.txt'
+    processed_file = 'processed_notes.txt'
+
+    if len(sys.argv) >= 2:
+        input_file = sys.argv[1]
+    if len(sys.argv) >= 3:
+        jira_file = sys.argv[2]
+    if len(sys.argv) >= 4:
+        pr_file = sys.argv[3]
+    if len(sys.argv) >= 5:
+        processed_file = sys.argv[4]
+
+    jira_tickets, pr_numbers, processed_lines = process_file(input_file)
+    save_results(jira_tickets, pr_numbers, processed_lines, jira_file, pr_file, processed_file)
--- a/.github/scripts/release-notes/pyproject.toml
+++ b/.github/scripts/release-notes/pyproject.toml
@@ -0,0 +1,4 @@
+[project]
+name = "release-notes-processor"
+description = "Process GitHub release notes to clean up formatting and extract relevant IDs."
+requires-python = ">=3.13"
--- a/.github/scripts/release-notes/test_linked_issues.py
+++ b/.github/scripts/release-notes/test_linked_issues.py
@@ -0,0 +1,30 @@
+import unittest
+from linked_issues import get_linked_issues, create_linked_issue_comment
+
+class TestLinkedIssues(unittest.TestCase):
+    def test_create_linked_issue_comment(self):
+        test_cases = [
+            ("bitwarden", "android", "v2025.1.0", "https://github.com/bitwarden/android/releases/tag/v2025.1.0", [4696]),
+            ("bitwarden", "android", "v2025.2.0", "https://github.com/bitwarden/android/releases/tag/v2025.2.0", [4809, 1, 2, 3]),
+            ("bitwarden", "android", "v2025.3.0", "https://github.com/bitwarden/android/releases/tag/v2025.3.0", []),
+        ]
+
+        for owner, repo, release_name, release_link, pr_numbers in test_cases:
+            with self.subTest(msg=f"Creating comment for issue in release {release_name}"):
+                comment = create_linked_issue_comment(owner, repo, release_name, release_link, pr_numbers)
+                print(comment + "\n")
+
+    def test_get_linked_issues(self):
+        test_cases = [
+            ("bitwarden", "android", 4696, [4659]),
+            ("bitwarden", "android", 4809, [])
+        ]
+
+        for owner, repo, pr_id, expected_linked_issues in test_cases:
+            with self.subTest(msg=f"Testing PR #{pr_id} for {owner}/{repo}"):
+                result = get_linked_issues(owner, repo, pr_id)
+                self.assertEqual(sorted(result), sorted(expected_linked_issues))
+
+
+if __name__ == '__main__':
+    unittest.main()
--- a/.github/scripts/release-notes/test_process_release_notes.py
+++ b/.github/scripts/release-notes/test_process_release_notes.py
@@ -0,0 +1,95 @@
+import unittest
+import tempfile
+import os
+from process_release_notes import extract_jira_tickets, extract_pr_numbers, process_line, process_file, get_linked_issues
+
+class TestProcessReleaseNotes(unittest.TestCase):
+    def setUp(self):
+        self.test_file = tempfile.NamedTemporaryFile(delete=False)
+
+    def tearDown(self):
+        os.unlink(self.test_file.name)
+
+    def test_extract_jira_tickets(self):
+        test_cases = [
+            ("[ABC-123] Some text", ["ABC-123"]),
+            ("DEF-456: Some text", ["DEF-456"]),
+            ("GHI-789 - Some text", ["GHI-789"]),
+            ("Multiple [ABC-123] and DEF-456: tickets", ["ABC-123", "DEF-456"]),
+            ("No tickets here", []),
+            ("Mixed formats ABC-123 [DEF-456] GHI-789:", ["ABC-123", "DEF-456", "GHI-789"])
+        ]
+        for input_text, expected in test_cases:
+            with self.subTest(input_text=input_text):
+                result = extract_jira_tickets(input_text)
+                self.assertEqual(result, expected)
+
+    def test_extract_pr_numbers(self):
+        test_cases = [
+            ("PR #123 text", ["123"]),
+            ("Multiple PRs #456 and #789", ["456", "789"]),
+            ("No PR numbers", [])
+        ]
+        for input_text, expected in test_cases:
+            with self.subTest(input_text=input_text):
+                result = extract_pr_numbers(input_text)
+                self.assertEqual(result, expected)
+
+    def test_process_line(self):
+        test_cases = [
+            ("[ABC-123] BACKPORT Some text", "Some text"),
+            ("DEF-456: feat(component): Some text", "Some text"),
+            ("GHI-789 - bug(fix): Some text", "Some text"),
+            ("ci: Some text", "Some text"),
+            ("ci(workflow): Some text", "Some text"),
+            ("feat: Direct feature", "Direct feature"),
+            ("bug: Simple bugfix", "Simple bugfix"),
+            ("Normal text", "Normal text")
+        ]
+        for input_text, expected in test_cases:
+            with self.subTest(input_text=input_text):
+                result = process_line(input_text)
+                self.assertEqual(result, expected)
+
+    def test_process_file(self):
+        content = """
+### Features:
+[ABC-123] feat(comp): Feature 1 #123
+DEF-456: bug(fix): Bug fix #456
+GHI-789 - BACKPORT Some text #789
+
+### Bug Fixes:
+Another line without changes
+"""
+        with open(self.test_file.name, 'w') as f:
+            f.write(content)
+
+        jira_tickets, pr_numbers, processed_lines = process_file(self.test_file.name)
+
+        self.assertEqual(jira_tickets, ["ABC-123", "DEF-456", "GHI-789"])
+        self.assertEqual(pr_numbers, ["123", "456", "789"])
+        self.assertEqual(processed_lines, [
+            '',
+            '### Features:',
+            'Feature 1 #123',
+            'Bug fix #456',
+            'Some text #789',
+            '',
+            '### Bug Fixes:',
+            'Another line without changes'
+        ])
+
+    def test_get_linked_issues(self):
+        test_cases = [
+            ("bitwarden", "android", 4696, [4659]),
+            ("bitwarden", "android", 4809, [])
+        ]
+
+        for owner, repo, pr_id, expected_linked_issues in test_cases:
+            with self.subTest(msg=f"Testing PR #{pr_id} for {owner}/{repo}"):
+                result = get_linked_issues(owner, repo, pr_id)
+                self.assertEqual(sorted(result), sorted(expected_linked_issues))
+
+
+if __name__ == '__main__':
+    unittest.main()
--- a/.github/scripts/validate-json/.python-version
+++ b/.github/scripts/validate-json/.python-version
@@ -1 +0,0 @@
-3.13
--- a/.github/scripts/validate-json/README.md
+++ b/.github/scripts/validate-json/README.md
@@ -1,39 +0,0 @@
-# JSON Validation Scripts
-
-Utility scripts for validating JSON files and checking for duplicate package names between Google and Community privileged browser lists.
-
-## Usage
-
-### Validate a JSON file
-
-```bash
-python validate_json.py validate <json_file>
-```
-
-### Check for duplicates between two JSON files
-
-```bash
-python validate_json.py duplicates <json_file1> <json_file2> [output_file]
-```
-
-If `output_file` is not specified, duplicates will be saved to `duplicates.txt`.
-
-## Running Tests
-
-```bash
-# Run all tests
-python -m unittest test_validate_json.py
-
-# Run the invalid JSON test individually
-python -m unittest test_validate_json.TestValidateJson.test_validate_json_invalid
-```
-
-## Examples
-
-```bash
-# Validate Google privileged browsers list
-python validate_json.py validate ../../app/src/main/assets/fido2_privileged_google.json
-
-# Check for duplicates between Google and Community lists
-python validate_json.py duplicates ../../app/src/main/assets/fido2_privileged_google.json ../../app/src/main/assets/fido2_privileged_community.json duplicates.txt
-```
--- a/.github/scripts/validate-json/fixtures/sample-invalid.json
+++ b/.github/scripts/validate-json/fixtures/sample-invalid.json
@@ -1,20 +0,0 @@
-{
-  "apps": [
-
-      "type": "android",
-      "info": {
-        "package_name": "com.android.chrome",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "19:75:B2:F1:71:77:BC:89:A5:DF:F3:1F:9E:64:A6:CA:E2:81:A5:3D:C1:D1:D5:9B:1D:14:7F:E1:C8:2A:FA:00"
-          }
-        ]
-      }
-    }
-  ]
-}
--- a/.github/scripts/validate-json/fixtures/sample-valid1.json
+++ b/.github/scripts/validate-json/fixtures/sample-valid1.json
@@ -1,48 +0,0 @@
-{
-  "apps": [
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.android.chrome",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "19:75:B2:F1:71:77:BC:89:A5:DF:F3:1F:9E:64:A6:CA:E2:81:A5:3D:C1:D1:D5:9B:1D:14:7F:E1:C8:2A:FA:00"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.chrome.dev",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "90:44:EE:5F:EE:4B:BC:5E:21:DD:44:66:54:31:C4:EB:1F:1F:71:A3:27:16:A0:BC:92:7B:CB:B3:92:33:CA:BF"
-          },
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "3D:7A:12:23:01:9A:A3:9D:9E:A0:E3:43:6A:B7:C0:89:6B:FB:4F:B6:79:F4:DE:5F:E7:C2:3F:32:6C:8F:99:4A"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.chrome.canary",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "DF:A1:FB:23:EF:BF:70:C5:BC:D1:44:3C:5B:EA:B0:4F:3F:2F:F4:36:6E:9A:C1:E3:45:76:39:A2:4C:FC"
-          }
-        ]
-      }
-    }
-  ]
-}
--- a/.github/scripts/validate-json/fixtures/sample-valid2.json
+++ b/.github/scripts/validate-json/fixtures/sample-valid2.json
@@ -1,20 +0,0 @@
-{
-  "apps": [
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.chromium.chrome",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "C6:AD:B8:B8:3C:6D:4C:17:D2:92:AF:DE:56:FD:48:8A:51:D3:16:FF:8F:2C:11:C5:41:02:23:BF:F8:A7:DB:B3"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "19:75:B2:F1:71:77:BC:89:A5:DF:F3:1F:9E:64:A6:CA:E2:81:A5:3D:C1:D1:D5:9B:1D:14:7F:E1:C8:2A:FA:00"
-          }
-        ]
-      }
-    }
-  ]
-}
--- a/.github/scripts/validate-json/test_validate_json.py
+++ b/.github/scripts/validate-json/test_validate_json.py
@@ -1,48 +0,0 @@
-#!/usr/bin/env python3
-import unittest
-import os
-import json
-from validate_json import validate_json, find_duplicates, get_package_names
-from unittest.mock import patch
-import io
-
-
-class TestValidateJson(unittest.TestCase):
-    def setUp(self):
-        self.valid_file = os.path.join(os.path.dirname(__file__), "fixtures/sample-valid1.json")
-        self.valid_file2 = os.path.join(os.path.dirname(__file__), "fixtures/sample-valid2.json")
-        self.invalid_file = os.path.join(os.path.dirname(__file__), "fixtures/sample-invalid.json")
-
-        # Suppress stdout
-        self.stdout_patcher = patch('sys.stdout', new=io.StringIO())
-        self.stdout_patcher.start()
-
-    def tearDown(self):
-        self.stdout_patcher.stop()
-
-    def test_validate_json_valid(self):
-        """Test validation of valid JSON file"""
-        self.assertTrue(validate_json(self.valid_file))
-
-    def test_validate_json_invalid(self):
-        """Test validation of invalid JSON file"""
-        self.assertFalse(validate_json(self.invalid_file))
-
-    def test_find_duplicates(self):
-        """Test when using the same file (should find duplicates)"""
-        expected_package_names = get_package_names(self.valid_file)
-
-        duplicates = find_duplicates(self.valid_file, self.valid_file)
-
-        self.assertEqual(len(duplicates), len(expected_package_names))
-        for package_name in expected_package_names:
-            self.assertIn(package_name, duplicates)
-
-    def test_find_duplicates_returns_empty_list_when_no_duplicates(self):
-        """Test when using different files (should not find duplicates)"""
-        duplicates = find_duplicates(self.valid_file, self.valid_file2)
-        self.assertEqual(len(duplicates), 0)
-
-
-if __name__ == "__main__":
-    unittest.main()
--- a/.github/scripts/validate-json/validate_json.py
+++ b/.github/scripts/validate-json/validate_json.py
@@ -1,145 +0,0 @@
-#!/usr/bin/env python3
-import json
-import sys
-import os
-from typing import List, Dict, Any, Set
-
-
-def get_package_names(file_path: str) -> Set[str]:
-    """
-    Extracts package names from a JSON file.
-
-    Args:
-        file_path: Path to the JSON file
-
-    Returns:
-        Set of package names
-    """
-    with open(file_path, 'r') as f:
-        data = json.load(f)
-
-    package_names = set()
-    for app in data["apps"]:
-        package_names.add(app["info"]["package_name"])
-
-    return package_names
-
-
-def validate_json(file_path: str) -> bool:
-    """
-    Validates if a JSON file is correctly formatted by attempting to deserialize it.
-
-    Args:
-        file_path: Path to the JSON file to validate
-
-    Returns:
-        True if valid, False otherwise
-    """
-    try:
-        if not os.path.exists(file_path):
-            print(f"Error: File {file_path} does not exist")
-            return False
-
-        with open(file_path, 'r') as f:
-            json.load(f)
-        print(f"✅ JSON file {file_path} is valid")
-        return True
-    except json.JSONDecodeError as e:
-        print(f"❌ Invalid JSON in {file_path}: {str(e)}")
-        return False
-    except Exception as e:
-        print(f"❌ Error validating {file_path}: {str(e)}")
-        return False
-
-
-def find_duplicates(file1_path: str, file2_path: str) -> List[str]:
-    """
-    Checks for duplicate package_name entries between two JSON files.
-
-    Args:
-        file1_path: Path to the first JSON file
-        file2_path: Path to the second JSON file
-
-    Returns:
-        List of duplicate package names, empty list if none found
-    """
-    try:
-        # Get package names from both files
-        packages1 = get_package_names(file1_path)
-        packages2 = get_package_names(file2_path)
-
-        # Find duplicates
-        duplicates = list(packages1.intersection(packages2))
-
-        if duplicates:
-            print(f"❌ Found {len(duplicates)} duplicate package names between {file1_path} and {file2_path}:")
-            for dup in duplicates:
-                print(f"  - {dup}")
-            return duplicates
-        else:
-            print(f"✅ No duplicate package names found between {file1_path} and {file2_path}")
-            return []
-
-    except Exception as e:
-        print(f"❌ Error checking duplicates: {str(e)}")
-        return []
-
-
-def save_duplicates_to_file(duplicates: List[str], output_file: str) -> None:
-    """
-    Saves the list of duplicates to a file.
-
-    Args:
-        duplicates: List of duplicate package names
-        output_file: Path to save the list of duplicates
-    """
-    try:
-        with open(output_file, 'w') as f:
-            for dup in duplicates:
-                f.write(f"{dup}\n")
-        print(f"Duplicates saved to {output_file}")
-    except Exception as e:
-        print(f"❌ Error saving duplicates to file: {str(e)}")
-
-
-def main():
-    if len(sys.argv) < 2:
-        print("Usage:")
-        print("  Validate JSON: python validate_json.py validate <json_file>")
-        print("  Check duplicates: python validate_json.py duplicates <json_file1> <json_file2> [output_file]")
-        sys.exit(1)
-
-    command = sys.argv[1]
-
-    match command:
-        case "validate":
-            if len(sys.argv) < 3:
-                print("Error: Missing JSON file path")
-                sys.exit(1)
-
-            file_path = sys.argv[2]
-            success = validate_json(file_path)
-            sys.exit(0 if success else 1)
-
-        case "duplicates":
-            if len(sys.argv) < 4:
-                print("Error: Missing JSON file paths")
-                sys.exit(1)
-
-            file1_path = sys.argv[2]
-            file2_path = sys.argv[3]
-            output_file = sys.argv[4] if len(sys.argv) > 4 else "duplicates.txt"
-
-            duplicates = find_duplicates(file1_path, file2_path)
-            if duplicates:
-                save_duplicates_to_file(duplicates, output_file)
-
-            sys.exit(0)
-
-        case _:
-            print(f"Unknown command: {command}")
-            sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()
--- a/.github/workflows/build-authenticator.yml
+++ b/.github/workflows/build-authenticator.yml
@@ -4,7 +4,6 @@ on:
  push:
    branches:
      - main
-      - release/**/*
  workflow_dispatch:
    inputs:
      version-name:
@@ -28,12 +27,7 @@ on:

 env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  JAVA_VERSION: 21
-
-permissions:
-  contents: read
-  packages: read
-  id-token: write
+  JAVA_VERSION: 17

 jobs:
  build:
@@ -41,29 +35,14 @@ jobs:
    runs-on: ubuntu-24.04

    steps:
-      - name: Log inputs to job summary
-        env:
-          INPUTS: ${{ toJson(inputs) }}
-        run: |
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          } >> "$GITHUB_STEP_SUMMARY"
-
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -73,7 +52,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -82,13 +61,13 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

@@ -99,7 +78,7 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Check Authenticator
-        run: bundle exec fastlane check
+        run: bundle exec fastlane checkAuthenticator

      - name: Build Authenticator
        run: bundle exec fastlane buildAuthenticatorDebug
@@ -116,12 +95,10 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

@@ -132,18 +109,9 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "BWA-AAB-KEYSTORE-STORE-PASSWORD,BWA-AAB-KEYSTORE-KEY-PASSWORD,BWA-APK-KEYSTORE-STORE-PASSWORD,BWA-APK-KEYSTORE-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
@@ -153,27 +121,27 @@ jobs:
          mkdir -p ${{ github.workspace }}/secrets
          mkdir -p ${{ github.workspace }}/keystores

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name authenticator_apk-keystore.jks --file ${{ github.workspace }}/keystores/authenticator_apk-keystore.jks --output none

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name authenticator_aab-keystore.jks --file ${{ github.workspace }}/keystores/authenticator_aab-keystore.jks --output none

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name com.bitwarden.authenticator-google-services.json --file ${{ github.workspace }}/authenticator/src/google-services.json --output none

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name com.bitwarden.authenticator.dev-google-services.json --file ${{ github.workspace }}/authenticator/src/debug/google-services.json --output none

      - name: Download Firebase credentials
-        if: ${{ inputs.distribute-to-firebase || github.event_name == 'push' }}
+        if : ${{ inputs.distribute-to-firebase || github.event_name == 'push' }}
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
        run: |
          mkdir -p ${{ github.workspace }}/secrets

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name authenticator_play_firebase-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_firebase-creds.json --output none

      - name: Download Play Store credentials
@@ -184,23 +152,20 @@ jobs:
        run: |
          mkdir -p ${{ github.workspace }}/secrets

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none

-      - name: AZ Logout
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Verify Play Store credentials
        if: ${{ inputs.publish-to-play-store }}
        run: |
          bundle exec fastlane run validate_play_store_json_key \
-          json_key:"${{ github.workspace }}/secrets/authenticator_play_store-creds.json"
+          json_key:${{ github.workspace }}/secrets/authenticator_play_store-creds.json }}

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -210,7 +175,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -219,66 +184,47 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      - name: Update app CI Build info
-        run: |
-          ./scripts/update_app_ci_build_info.sh \
-          "$GITHUB_REPOSITORY" \
-          "$GITHUB_REF_NAME" \
-          "$GITHUB_SHA" \
-          "$GITHUB_RUN_ID" \
-          "$GITHUB_RUN_ATTEMPT"
-
      - name: Increment version
-        env:
-          DEFAULT_VERSION_CODE: ${{ github.run_number }}
-          INPUT_VERSION_CODE: "${{ inputs.version-code }}"
-          INPUT_VERSION_NAME: ${{ inputs.version-name }}
        run: |
-          VERSION_CODE="${INPUT_VERSION_CODE:-$DEFAULT_VERSION_CODE}"
-          VERSION_NAME_INPUT="${INPUT_VERSION_NAME:-}"
-          bundle exec fastlane setBuildVersionInfo \
-          versionCode:"$VERSION_CODE" \
-          versionName:"$VERSION_NAME_INPUT"
+          DEFAULT_VERSION_CODE=$GITHUB_RUN_NUMBER
+          VERSION_CODE="${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }}"
+          bundle exec fastlane setAuthenticatorBuildVersionInfo \
+          versionCode:$VERSION_CODE \
+          versionName:${{ inputs.version-name || '' }}

-          regex='appVersionName = "([^"]+)"'
-          if [[ "$(cat gradle/libs.versions.toml)" =~ $regex ]]; then
+          regex='versionName = "([^"]+)"'
+          if [[ "$(cat authenticator/build.gradle.kts)" =~ $regex ]]; then
            VERSION_NAME="${BASH_REMATCH[1]}"
          fi
-          echo "Version Name: ${VERSION_NAME}" >> "$GITHUB_STEP_SUMMARY"
-          echo "Version Number: $VERSION_CODE" >> "$GITHUB_STEP_SUMMARY"
+          echo "Version Name: ${VERSION_NAME}" >> $GITHUB_STEP_SUMMARY
+          echo "Version Number: $VERSION_CODE" >> $GITHUB_STEP_SUMMARY

      - name: Generate release Play Store bundle
        if: ${{ matrix.variant == 'aab' }}
-        env:
-          STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-STORE-PASSWORD }}
-          KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-KEY-PASSWORD }}
        run: |
          bundle exec fastlane bundleAuthenticatorRelease \
-          storeFile:"${{ github.workspace }}/keystores/authenticator_aab-keystore.jks" \
-          storePassword:"$STORE_PASSWORD" \
-          keyAlias:"authenticatorupload" \
-          keyPassword:"$KEY_PASSWORD"
+          storeFile:${{ github.workspace }}/keystores/authenticator_aab-keystore.jks \
+          storePassword:'${{ secrets.BWA_AAB_KEYSTORE_STORE_PASSWORD }}' \
+          keyAlias:authenticatorupload \
+          keyPassword:'${{ secrets.BWA_AAB_KEYSTORE_KEY_PASSWORD }}'

      - name: Generate release Play Store APK
        if: ${{ matrix.variant == 'apk' }}
-        env:
-          STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-STORE-PASSWORD }}
-          KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-KEY-PASSWORD }}
        run: |
          bundle exec fastlane buildAuthenticatorRelease \
-          storeFile:"${{ github.workspace }}/keystores/authenticator_apk-keystore.jks" \
-          storePassword:"$STORE_PASSWORD" \
-          keyAlias:"bitwardenauthenticator" \
-          keyPassword:"$KEY_PASSWORD"
+          storeFile:${{ github.workspace }}/keystores/authenticator_apk-keystore.jks \
+          storePassword:'${{ secrets.BWA_APK_KEYSTORE_STORE_PASSWORD }}' \
+          keyAlias:bitwardenauthenticator \
+          keyPassword:'${{ secrets.BWA_APK_KEYSTORE_KEY_PASSWORD }}'

      - name: Upload release Play Store .aab artifact
        if: ${{ matrix.variant == 'aab' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.bitwarden.authenticator.aab
          path: authenticator/build/outputs/bundle/release/com.bitwarden.authenticator.aab
@@ -286,7 +232,7 @@ jobs:

      - name: Upload release .apk artifact
        if: ${{ matrix.variant == 'apk' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.bitwarden.authenticator.apk
          path: authenticator/build/outputs/apk/release/com.bitwarden.authenticator.apk
@@ -306,7 +252,7 @@ jobs:

      - name: Upload .apk SHA file for release
        if: ${{ matrix.variant == 'apk' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: authenticator-android-apk-sha256.txt
          path: ./authenticator-android-apk-sha256.txt
@@ -314,7 +260,7 @@ jobs:

      - name: Upload .aab SHA file for release
        if: ${{ matrix.variant == 'aab' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: authenticator-android-aab-sha256.txt
          path: ./authenticator-android-aab-sha256.txt
@@ -330,7 +276,7 @@ jobs:
          FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/authenticator_play_firebase-creds.json
        run: |
          bundle exec fastlane distributeAuthenticatorReleaseBundleToFirebase \
-          serviceCredentialsFile:"$FIREBASE_CREDS_PATH"
+          serviceCredentialsFile:${{ env.FIREBASE_CREDS_PATH }}

      # Only publish bundles to Play Store when `publish-to-play-store` is true while building
      # bundles
@@ -340,4 +286,4 @@ jobs:
          PLAY_STORE_CREDS_FILE: ${{ github.workspace }}/secrets/authenticator_play_store-creds.json
        run: |
          bundle exec fastlane publishAuthenticatorReleaseToGooglePlayStore \
-          serviceCredentialsFile:"$PLAY_STORE_CREDS_FILE" \
+          serviceCredentialsFile:${{ env.PLAY_STORE_CREDS_FILE }} \
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,7 +4,6 @@ on:
  push:
    branches:
      - main
-      - release/**/*
  workflow_dispatch:
    inputs:
      version-name:
@@ -18,53 +17,33 @@ on:
      distribute-to-firebase:
        description: "Optional. Distribute artifacts to Firebase."
        required: false
-        default: true
+        default: false
        type: boolean
      publish-to-play-store:
        description: "Optional. Deploy bundle artifact to Google Play Store"
        required: false
-        default: true
+        default: false
        type: boolean

 env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  JAVA_VERSION: 21
+  JAVA_VERSION: 17
  GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

-permissions:
-  contents: read
-  packages: read
-  id-token: write
-
 jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04

    steps:
-      - name: Log inputs to job summary
-        env:
-          INPUTS: ${{ toJson(inputs) }}
-        run: |
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          } >> "$GITHUB_STEP_SUMMARY"
-
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -74,7 +53,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -83,13 +62,13 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

@@ -106,7 +85,7 @@ jobs:
        run: bundle exec fastlane assembleDebugApks

      - name: Upload test reports on failure
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: test-reports
@@ -124,12 +103,10 @@ jobs:
        artifact: ["apk", "aab"]
    steps:
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

@@ -140,18 +117,9 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "UPLOAD-KEYSTORE-PASSWORD,UPLOAD-BETA-KEYSTORE-PASSWORD,UPLOAD-BETA-KEY-PASSWORD,PLAY-KEYSTORE-PASSWORD,PLAY-BETA-KEYSTORE-PASSWORD,PLAY-BETA-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
@@ -162,19 +130,19 @@ jobs:
          mkdir -p ${{ github.workspace }}/app/src/standardBeta
          mkdir -p ${{ github.workspace }}/app/src/standardRelease

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_play-keystore.jks --file ${{ github.workspace }}/keystores/app_play-keystore.jks --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_upload-keystore.jks --file ${{ github.workspace }}/keystores/app_upload-keystore.jks --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name play_creds.json --file ${{ github.workspace }}/secrets/play_creds.json --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_beta_play-keystore.jks --file ${{ github.workspace }}/keystores/app_beta_play-keystore.jks --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_beta_upload-keystore.jks --file ${{ github.workspace }}/keystores/app_beta_upload-keystore.jks --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name google-services.json --file ${{ github.workspace }}/app/src/standardRelease/google-services.json --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name google-services.json --file ${{ github.workspace }}/app/src/standardBeta/google-services.json --output none

      - name: Download Firebase credentials
@@ -185,17 +153,14 @@ jobs:
        run: |
          mkdir -p ${{ github.workspace }}/secrets

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_play_prod_firebase-creds.json --file ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json --output none

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -205,7 +170,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -214,7 +179,7 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}
@@ -222,67 +187,64 @@ jobs:
      - name: Update app CI Build info
        run: |
          ./scripts/update_app_ci_build_info.sh \
-          "$GITHUB_REPOSITORY" \
-          "$GITHUB_REF_NAME" \
-          "$GITHUB_SHA" \
-          "$GITHUB_RUN_ID" \
-          "$GITHUB_RUN_ATTEMPT"
+          $GITHUB_REPOSITORY \
+          $GITHUB_REF_NAME \
+          $GITHUB_SHA \
+          $GITHUB_RUN_ID \
+          $GITHUB_RUN_ATTEMPT

      - name: Increment version
-        env:
-          VERSION_CODE: ${{ inputs.version-code }}
-          VERSION_NAME: ${{ inputs.version-name }}
        run: |
-          VERSION_CODE="${VERSION_CODE:-$((11000 + GITHUB_RUN_NUMBER))}"
+          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
          bundle exec fastlane setBuildVersionInfo \
-          versionCode:$VERSION_CODE \
-          versionName:$VERSION_NAME
+          versionCode:${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }} \
+          versionName:${{ inputs.version-name }}

      - name: Generate release Play Store bundle
        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' }}
        env:
-          UPLOAD_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-KEYSTORE-PASSWORD }}
+          UPLOAD_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane bundlePlayStoreRelease \
          storeFile:app_upload-keystore.jks \
-          storePassword:$UPLOAD_KEYSTORE_PASSWORD \
+          storePassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }} \
          keyAlias:upload \
-          keyPassword:$UPLOAD_KEYSTORE_PASSWORD
+          keyPassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }}

      - name: Generate beta Play Store bundle
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        env:
-          UPLOAD_BETA_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-BETA-KEYSTORE-PASSWORD }}
-          UPLOAD_BETA_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-BETA-KEY-PASSWORD }}
+          UPLOAD_BETA_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_BETA_KEYSTORE_PASSWORD }}
+          UPLOAD_BETA_KEY_PASSWORD: ${{ secrets.UPLOAD_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane bundlePlayStoreBeta \
          storeFile:app_beta_upload-keystore.jks \
-          storePassword:$UPLOAD_BETA_KEYSTORE_PASSWORD \
+          storePassword:${{ env.UPLOAD_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta-upload \
-          keyPassword:$UPLOAD_BETA_KEY_PASSWORD
+          keyPassword:${{ env.UPLOAD_BETA_KEY_PASSWORD }}

      - name: Generate release Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
-          PLAY_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-KEYSTORE-PASSWORD }}
+          PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane assemblePlayStoreReleaseApk \
          storeFile:app_play-keystore.jks \
-          storePassword:$PLAY_KEYSTORE_PASSWORD \
+          storePassword:${{ env.PLAY_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden \
-          keyPassword:$PLAY_KEYSTORE_PASSWORD
+          keyPassword:${{ env.PLAY_KEYSTORE_PASSWORD }}

      - name: Generate beta Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
-          PLAY_BETA_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEYSTORE-PASSWORD }}
-          PLAY_BETA_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEY-PASSWORD }}
+          PLAY_BETA_KEYSTORE_PASSWORD: ${{ secrets.PLAY_BETA_KEYSTORE_PASSWORD }}
+          PLAY_BETA_KEY_PASSWORD: ${{ secrets.PLAY_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane assemblePlayStoreBetaApk \
          storeFile:app_beta_play-keystore.jks \
-          storePassword:$PLAY_BETA_KEYSTORE_PASSWORD \
+          storePassword:${{ env.PLAY_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta \
-          keyPassword:$PLAY_BETA_KEY_PASSWORD
+          keyPassword:${{ env.PLAY_BETA_KEY_PASSWORD }}

      - name: Generate debug Play Store APKs
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
@@ -291,7 +253,7 @@ jobs:

      - name: Upload release Play Store .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.aab
          path: app/build/outputs/bundle/standardRelease/com.x8bit.bitwarden.aab
@@ -299,7 +261,7 @@ jobs:

      - name: Upload beta Play Store .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta.aab
          path: app/build/outputs/bundle/standardBeta/com.x8bit.bitwarden.beta.aab
@@ -307,7 +269,7 @@ jobs:

      - name: Upload release .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.apk
          path: app/build/outputs/apk/standard/release/com.x8bit.bitwarden.apk
@@ -315,7 +277,7 @@ jobs:

      - name: Upload beta .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta.apk
          path: app/build/outputs/apk/standard/beta/com.x8bit.bitwarden.beta.apk
@@ -324,7 +286,7 @@ jobs:
      # When building variants other than 'prod'
      - name: Upload debug .apk artifact
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.${{ matrix.variant }}.apk
          path: app/build/outputs/apk/standard/debug/com.x8bit.bitwarden.dev.apk
@@ -362,7 +324,7 @@ jobs:

      - name: Upload .apk SHA file for release
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.apk-sha256.txt
          path: ./com.x8bit.bitwarden.apk-sha256.txt
@@ -370,7 +332,7 @@ jobs:

      - name: Upload .apk SHA file for beta
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta.apk-sha256.txt
          path: ./com.x8bit.bitwarden.beta.apk-sha256.txt
@@ -378,7 +340,7 @@ jobs:

      - name: Upload .aab SHA file for release
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.aab-sha256.txt
          path: ./com.x8bit.bitwarden.aab-sha256.txt
@@ -386,7 +348,7 @@ jobs:

      - name: Upload .aab SHA file for beta
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta.aab-sha256.txt
          path: ./com.x8bit.bitwarden.beta.aab-sha256.txt
@@ -394,7 +356,7 @@ jobs:

      - name: Upload .apk SHA file for debug
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.${{ matrix.variant }}.apk-sha256.txt
          path: ./com.x8bit.bitwarden.${{ matrix.variant }}.apk-sha256.txt
@@ -410,8 +372,8 @@ jobs:
          APP_PLAY_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json
        run: |
          bundle exec fastlane distributeReleasePlayStoreToFirebase \
-          actionUrl:$GITHUB_ACTION_RUN_URL \
-          service_credentials_file:$APP_PLAY_FIREBASE_CREDS_PATH
+          actionUrl:${{ env.GITHUB_ACTION_RUN_URL }} \
+          service_credentials_file:${{ env.APP_PLAY_FIREBASE_CREDS_PATH }}

      - name: Publish beta artifacts to Firebase
        if: ${{ (matrix.variant == 'prod' && matrix.artifact == 'apk') && (inputs.distribute-to-firebase || github.event_name == 'push') }}
@@ -419,8 +381,8 @@ jobs:
          APP_PLAY_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json
        run: |
          bundle exec fastlane distributeBetaPlayStoreToFirebase \
-          actionUrl:$GITHUB_ACTION_RUN_URL \
-          service_credentials_file:$APP_PLAY_FIREBASE_CREDS_PATH
+          actionUrl:${{ env.GITHUB_ACTION_RUN_URL }} \
+          service_credentials_file:${{ env.APP_PLAY_FIREBASE_CREDS_PATH }}

      - name: Verify Play Store credentials
        if: ${{ matrix.variant == 'prod' && inputs.publish-to-play-store }}
@@ -428,7 +390,7 @@ jobs:
          bundle exec fastlane run validate_play_store_json_key

      - name: Publish Play Store bundle
-        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' && (inputs.publish-to-play-store || github.event_name == 'push') }}
+        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' && (inputs.publish-to-play-store || github.ref_name == 'main') }}
        run: |
          bundle exec fastlane publishProdToPlayStore
          bundle exec fastlane publishBetaToPlayStore
@@ -440,12 +402,10 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

@@ -456,27 +416,18 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "FDROID-KEYSTORE-PASSWORD,FDROID-BETA-KEYSTORE-PASSWORD,FDROID-BETA-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
        run: |
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_fdroid-keystore.jks --file ${{ github.workspace }}/keystores/app_fdroid-keystore.jks --output none
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_beta_fdroid-keystore.jks --file ${{ github.workspace }}/keystores/app_beta_fdroid-keystore.jks --output none

      - name: Download Firebase credentials
@@ -487,17 +438,14 @@ jobs:
        run: |
          mkdir -p ${{ github.workspace }}/secrets

-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_fdroid_firebase-creds.json --file ${{ github.workspace }}/secrets/app_fdroid_firebase-creds.json --output none

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -507,7 +455,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -516,7 +464,7 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}
@@ -524,52 +472,50 @@ jobs:
      - name: Update app CI Build info
        run: |
          ./scripts/update_app_ci_build_info.sh \
-          "$GITHUB_REPOSITORY" \
-          "$GITHUB_REF_NAME" \
-          "$GITHUB_SHA" \
-          "$GITHUB_RUN_ID" \
-          "$GITHUB_RUN_ATTEMPT"
+          $GITHUB_REPOSITORY \
+          $GITHUB_REF_NAME \
+          $GITHUB_SHA \
+          $GITHUB_RUN_ID \
+          $GITHUB_RUN_ATTEMPT

      # Start from 11000 to prevent collisions with mobile build version codes
      - name: Increment version
-        env:
-          VERSION_CODE: ${{ inputs.version-code }}
-          VERSION_NAME: ${{ inputs.version-name }}
        run: |
-          VERSION_CODE="${VERSION_CODE:-$((11000 + GITHUB_RUN_NUMBER))}"
+          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
+          VERSION_CODE="${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }}"
          bundle exec fastlane setBuildVersionInfo \
          versionCode:$VERSION_CODE \
-          versionName:$VERSION_NAME
+          versionName:${{ inputs.version-name || '' }}

-          regex='appVersionName = "([^"]+)"'
-          if [[ "$(cat gradle/libs.versions.toml)" =~ $regex ]]; then
+          regex='versionName = "([^"]+)"'
+          if [[ "$(cat app/build.gradle.kts)" =~ $regex ]]; then
            VERSION_NAME="${BASH_REMATCH[1]}"
          fi
-          echo "Version Name: ${VERSION_NAME}" >> "$GITHUB_STEP_SUMMARY"
-          echo "Version Number: $VERSION_CODE" >> "$GITHUB_STEP_SUMMARY"
+          echo "Version Name: ${VERSION_NAME}" >> $GITHUB_STEP_SUMMARY
+          echo "Version Number: $VERSION_CODE" >> $GITHUB_STEP_SUMMARY
      - name: Generate F-Droid artifacts
        env:
-          FDROID_STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-KEYSTORE-PASSWORD }}
+          FDROID_STORE_PASSWORD: ${{ secrets.FDROID_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane assembleFDroidReleaseApk \
          storeFile:app_fdroid-keystore.jks \
-          storePassword:$FDROID_STORE_PASSWORD \
+          storePassword:"${{ env.FDROID_STORE_PASSWORD }}" \
          keyAlias:bitwarden \
-          keyPassword:$FDROID_STORE_PASSWORD
+          keyPassword:"${{ env.FDROID_STORE_PASSWORD }}"

      - name: Generate F-Droid Beta Artifacts
        env:
-          FDROID_BETA_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-BETA-KEYSTORE-PASSWORD }}
-          FDROID_BETA_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-BETA-KEY-PASSWORD }}
+          FDROID_BETA_KEYSTORE_PASSWORD: ${{ secrets.FDROID_BETA_KEYSTORE_PASSWORD }}
+          FDROID_BETA_KEY_PASSWORD: ${{ secrets.FDROID_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane assembleFDroidBetaApk \
          storeFile:app_beta_fdroid-keystore.jks \
-          storePassword:$FDROID_BETA_KEYSTORE_PASSWORD \
+          storePassword:"${{ env.FDROID_BETA_KEYSTORE_PASSWORD }}" \
          keyAlias:bitwarden-beta \
-          keyPassword:$FDROID_BETA_KEY_PASSWORD
+          keyPassword:"${{ env.FDROID_BETA_KEY_PASSWORD }}"

      - name: Upload F-Droid .apk artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden-fdroid.apk
          path: app/build/outputs/apk/fdroid/release/com.x8bit.bitwarden-fdroid.apk
@@ -581,14 +527,14 @@ jobs:
          > ./com.x8bit.bitwarden-fdroid.apk-sha256.txt

      - name: Upload F-Droid SHA file
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden-fdroid.apk-sha256.txt
          path: ./com.x8bit.bitwarden-fdroid.apk-sha256.txt
          if-no-files-found: error

      - name: Upload F-Droid Beta .apk artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta-fdroid.apk
          path: app/build/outputs/apk/fdroid/beta/com.x8bit.bitwarden.beta-fdroid.apk
@@ -600,7 +546,7 @@ jobs:
          > ./com.x8bit.bitwarden.beta-fdroid.apk-sha256.txt

      - name: Upload F-Droid Beta SHA file
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: com.x8bit.bitwarden.beta-fdroid.apk-sha256.txt
          path: ./com.x8bit.bitwarden.beta-fdroid.apk-sha256.txt
@@ -616,5 +562,5 @@ jobs:
          APP_FDROID_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_fdroid_firebase-creds.json
        run: |
          bundle exec fastlane distributeReleaseFDroidToFirebase \
-          actionUrl:$GITHUB_ACTION_RUN_URL \
-          service_credentials_file:$APP_FDROID_FIREBASE_CREDS_PATH
+          actionUrl:${{ env.GITHUB_ACTION_RUN_URL }} \
+          service_credentials_file:${{ env.APP_FDROID_FIREBASE_CREDS_PATH }}
--- a/.github/workflows/cron-sync-google-priviledged-browsers.yml
+++ b/.github/workflows/cron-sync-google-priviledged-browsers.yml
@@ -1,99 +0,0 @@
-name: Cron / Sync Google Privileged Browsers List
-
-on:
-  schedule:
-    # Run weekly on Monday at 00:00 UTC
-    - cron: "0 0 * * 1"
-  workflow_dispatch:
-
-env:
-  SOURCE_URL: https://www.gstatic.com/gpm-passkeys-privileged-apps/apps.json
-  GOOGLE_FILE: app/src/main/assets/fido2_privileged_google.json
-  COMMUNITY_FILE: app/src/main/assets/fido2_privileged_community.json
-
-jobs:
-  sync-privileged-browsers:
-    name: Sync Google Privileged Browsers List
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: true
-
-      - name: Download Google Privileged Browsers List
-        run: curl -s "$SOURCE_URL" -o "$GOOGLE_FILE"
-
-      - name: Check for changes
-        id: check-changes
-        run: |
-          if git diff --quiet -- "$GOOGLE_FILE"; then
-            echo "👀 No changes detected, skipping..."
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          echo "👀 Changes detected, validating fido2_privileged_google.json..."
-
-          if ! python .github/scripts/validate-json/validate_json.py validate "$GOOGLE_FILE"; then
-            echo "::error::JSON validation failed for $GOOGLE_FILE"
-            exit 1
-          fi
-
-          echo "👀 fido2_privileged_google.json is valid, checking for duplicates..."
-
-          # Check for duplicates between Google and Community files
-          python .github/scripts/validate-json/validate_json.py duplicates "$GOOGLE_FILE" "$COMMUNITY_FILE" duplicates.txt
-
-          if [ -f duplicates.txt ]; then
-            echo "::warning::Duplicate package names found between Google and Community files."
-            echo "duplicates_found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "✅ No duplicate package names found between Google and Community files"
-            echo "duplicates_found=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create branch and commit
-        if: steps.check-changes.outputs.has_changes == 'true'
-        run: |
-          echo "👀 Committing fido2_privileged_google.json..."
-
-          BRANCH_NAME="cron-sync-privileged-browsers/$GITHUB_RUN_NUMBER-sync"
-          git config user.name "GitHub Actions Bot"
-          git config user.email "actions@github.com"
-          git checkout -b "$BRANCH_NAME"
-          git add "$GOOGLE_FILE"
-          git commit -m "Update Google privileged browsers list"
-          git push origin "$BRANCH_NAME"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
-          echo "🌱 Branch created: $BRANCH_NAME"
-
-      - name: Create Pull Request
-        if: steps.check-changes.outputs.has_changes == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DUPLICATES_FOUND: ${{ steps.check-changes.outputs.duplicates_found }}
-          BASE_PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/
-        run: |
-          PR_BODY="Updates the Google privileged browsers list with the latest data from $SOURCE_URL"
-
-          if [ "$DUPLICATES_FOUND" = "true" ]; then
-            PR_BODY="$PR_BODY\n\n> [!WARNING]\n> :suspect: The following package(s) appear in both Google and Community files:"
-            while IFS= read -r line; do
-              PR_BODY="$PR_BODY\n> - $line"
-            done < duplicates.txt
-          fi
-
-          # Use echo -e to interpret escape sequences and pipe to gh pr create
-          echo -e "$PR_BODY" | gh pr create \
-            --title "Update Google privileged browsers list" \
-            --body-file - \
-            --base main \
-            --head "$BRANCH_NAME" \
-            --label "automated-pr" \
-            --label "t:ci"
--- a/.github/workflows/crowdin-pull-authenticator.yml
+++ b/.github/workflows/crowdin-pull-authenticator.yml
@@ -0,0 +1,56 @@
+name: Crowdin Sync - Authenticator
+
+on:
+  workflow_dispatch:
+    inputs: {}
+  schedule:
+    - cron: '0 0 * * 5'
+
+jobs:
+  crowdin-sync:
+    name: Autosync
+    runs-on: ubuntu-24.04
+    env:
+      _CROWDIN_PROJECT_ID: "673718"
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Log in to Azure - CI Subscription
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+        with:
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+
+      - name: Retrieve secrets
+        id: retrieve-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: "bitwarden-ci"
+          secrets: "github-gpg-private-key, github-gpg-private-key-passphrase"
+
+      - name: Generate GH App token
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ secrets.BW_GHAPP_ID }}
+          private-key: ${{ secrets.BW_GHAPP_KEY }}
+
+      - name: Download translations
+        uses: crowdin/github-action@d1632879d4d4da358f2d040f79fa094571c9a649 # v2.5.1
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_TOKEN }}
+        with:
+          config: crowdin-bwa.yml
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          github_user_name: "bitwarden-devops-bot"
+          github_user_email: "106330231+bitwarden-devops-bot@users.noreply.github.com"
+          commit_message: "Autosync the updated translations"
+          localization_branch_name: crowdin-auto-sync
+          create_pull_request: true
+          pull_request_title: "Autosync Crowdin Translations"
+          pull_request_body: "Autosync the updated translations"
+          gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
+          gpg_passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -1,38 +1,25 @@
-name: Cron / Crowdin Pull
-run-name: Crowdin Pull - ${{ github.event_name == 'workflow_dispatch' && 'Manual' || 'Scheduled' }}
+name: Crowdin Sync

 on:
  workflow_dispatch:
+    inputs: {}
  schedule:
-    - cron: "0 0 * * 5"
+    - cron: '0 0 * * 5'

 jobs:
  crowdin-sync:
-    name: Crowdin Pull - ${{ github.event_name }}
+    name: Autosync
    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
+    env:
+      _CROWDIN_PROJECT_ID: "269690"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+      - name: Login to Azure - CI Subscription
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -41,22 +28,18 @@ jobs:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token, github-gpg-private-key, github-gpg-private-key-passphrase"

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Generate GH App token
-        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
        id: app-token
        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          app-id: ${{ secrets.BW_GHAPP_ID }}
+          private-key: ${{ secrets.BW_GHAPP_KEY }}

      - name: Download translations
-        uses: crowdin/github-action@0749939f635900a2521aa6aac7a3766642b2dc71 # v2.11.0
+        uses: crowdin/github-action@d1632879d4d4da358f2d040f79fa094571c9a649 # v2.5.1
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
-          _CROWDIN_PROJECT_ID: "269690"
        with:
          config: crowdin.yml
          upload_sources: false
@@ -64,10 +47,10 @@ jobs:
          download_translations: true
          github_user_name: "bitwarden-devops-bot"
          github_user_email: "106330231+bitwarden-devops-bot@users.noreply.github.com"
-          commit_message: "Crowdin Pull"
-          localization_branch_name: "crowdin-pull"
+          commit_message: "Autosync the updated translations"
+          localization_branch_name: crowdin-auto-sync
          create_pull_request: true
-          pull_request_title: "Crowdin Pull"
-          pull_request_body: ":inbox_tray: New translations received!"
+          pull_request_title: "Autosync Crowdin Translations"
+          pull_request_body: "Autosync the updated translations"
          gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
          gpg_passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
--- a/.github/workflows/crowdin-push-authenticator.yml
+++ b/.github/workflows/crowdin-push-authenticator.yml
@@ -0,0 +1,30 @@
+name: Crowdin Push - Authenticator
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  JAVA_VERSION: 17
+
+jobs:
+  crowdin-push:
+    name: Crowdin Push
+    runs-on: ubuntu-24.04
+    env:
+      _CROWDIN_PROJECT_ID: "673718"
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Upload sources
+        uses: crowdin/github-action@d1632879d4d4da358f2d040f79fa094571c9a649 # v2.5.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_TOKEN }}
+        with:
+          config: crowdin-bwa.yml
+          upload_sources: true
+          upload_translations: false
--- a/.github/workflows/crowdin-push.yml
+++ b/.github/workflows/crowdin-push.yml
@@ -1,31 +1,25 @@
-name: CI / Crowdin Push
-run-name: Crowdin Push - ${{ github.event_name == 'workflow_dispatch' && 'Manual' || 'CI' }}
+name: Crowdin Push

 on:
  workflow_dispatch:
  push:
    branches:
-      - main
+      - "main"

 jobs:
  crowdin-push:
-    name: Crowdin Push - ${{ github.event_name }}
+    name: Crowdin Push
    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      id-token: write
+    env:
+      _CROWDIN_PROJECT_ID: "269690"
    steps:
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -35,15 +29,11 @@ jobs:
          secrets: "crowdin-api-token"

      - name: Upload sources
-        uses: crowdin/github-action@0749939f635900a2521aa6aac7a3766642b2dc71 # v2.11.0
+        uses: crowdin/github-action@d1632879d4d4da358f2d040f79fa094571c9a649 # v2.5.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
-          _CROWDIN_PROJECT_ID: "269690"
        with:
          config: crowdin.yml
          upload_sources: true
          upload_translations: false
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -3,287 +3,127 @@ name: Create GitHub Release
 on:
  workflow_dispatch:
    inputs:
+      version-name:
+        description: 'Version Name - E.g. "2024.11.1"'
+        required: true
+        type: string
+      version-number:
+        description: 'Version Number - E.g. "123456"'
+        required: true
+        type: string
      artifact-run-id:
-        description: "GitHub Action Run ID containing artifacts"
+        description: 'GitHub Action Run ID containing artifacts'
        required: true
        type: string
-      release-ticket-id:
-        description: "Release Ticket ID - e.g. RELEASE-1762"
-        required: true
-        type: string
-
+      draft:
+        description: 'Create as draft release'
+        type: boolean
+        default: true
+      prerelease:
+        description: 'Mark as pre-release'
+        type: boolean
+        default: true
+      make-latest:
+        description: 'Set as the latest release'
+        type: boolean
+      branch-protection-type:
+        description: 'Branch protection type'
+        type: choice
+        options:
+          - Branch Name
+          - GitHub API
+        default: Branch Name
 env:
-  ARTIFACTS_PATH: artifacts
-
+    ARTIFACTS_PATH: artifacts
 jobs:
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-24.04
    permissions:
      contents: write
-      id-token: write
+      actions: read

    steps:
      - name: Check out repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
-          persist-credentials: true
-
-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}

      - name: Get branch from workflow run
        id: get_release_branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
+          BRANCH_PROTECTION_TYPE: ${{ inputs.branch-protection-type }}
        run: |
-          workflow_data=$(gh run view "$ARTIFACT_RUN_ID" --json headBranch,workflowName)
-          release_branch=$(echo "$workflow_data" | jq -r .headBranch)
-          workflow_name=$(echo "$workflow_data" | jq -r .workflowName)
+          release_branch=$(gh run view $ARTIFACT_RUN_ID --json headBranch -q .headBranch)

-          # branch protection check
-          if [[ "$release_branch" != "main" && ! "$release_branch" =~ ^release/ ]]; then
-            echo "::error::Branch '$release_branch' is not 'main' or a release branch starting with 'release/'. Releases must be created from protected branches."
-            exit 1
-          fi
-
-          echo "🔖 Release branch: $release_branch"
-          echo "🔖 Workflow name: $workflow_name"
-          echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"
-          echo "workflow_name=$workflow_name" >> "$GITHUB_OUTPUT"
-
-          case "$workflow_name" in
-            *"Password Manager"* | "Build")
-              app_name="Password Manager"
-              app_name_suffix="bwpm"
+          case "$BRANCH_PROTECTION_TYPE" in
+            "Branch Name")
+              if [[ "$release_branch" != "main" && ! "$release_branch" =~ ^release/ ]]; then
+                echo "::error::Branch '$release_branch' is not 'main' or a release branch starting with 'release/'. Releases must be created from protected branches."
+                exit 1
+              fi
              ;;
-            *"Authenticator"*)
-              app_name="Authenticator"
-              app_name_suffix="bwa"
+            "GitHub API")
+              #NOTE requires token with "administration:read" scope
+              if ! gh api "repos/${{ github.repository }}/branches/$release_branch/protection" | grep -q "required_status_checks"; then
+                echo "::error::Branch '$release_branch' is not protected. Releases must be created from protected branches. If that's not correct, confirm if the github token user has the 'administration:read' scope."
+                exit 1
+              fi
              ;;
            *)
-              echo "::error::Unknown workflow name: $workflow_name"
+              echo "::error::Unsupported branch protection type: $BRANCH_PROTECTION_TYPE"
              exit 1
              ;;
          esac
-          echo "🔖 App name: $app_name"
-          echo "🔖 App name suffix: $app_name_suffix"
-          echo "app_name=$app_name" >> "$GITHUB_OUTPUT"
-          echo "app_name_suffix=$app_name_suffix" >> "$GITHUB_OUTPUT"

-      - name: Get version info from run logs and set release tag name
-        id: get_release_info
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _APP_NAME_SUFFIX: ${{ steps.get_release_branch.outputs.app_name_suffix }}
-        run: |
-          workflow_log=$(gh run view "$ARTIFACT_RUN_ID" --log)
-
-          version_number_with_trailing_dot=$(grep -m 1 "Setting version code to" <<< "$workflow_log" | sed 's/.*Setting version code to //')
-          version_number=${version_number_with_trailing_dot%.} # remove trailing dot
-
-          version_name_with_trailing_dot=$(grep -m 1 "Setting version name to" <<< "$workflow_log" | sed 's/.*Setting version name to //')
-          version_name=${version_name_with_trailing_dot%.} # remove trailing dot
-
-          if [[ -z "$version_name" ]]; then
-            echo "::warning::Version name not found. Using default value - 0.0.0"
-            version_name="0.0.0"
-          else
-            echo "✅ Found version name: $version_name"
-          fi
-
-          if [[ -z "$version_number" ]]; then
-            echo "::warning::Version number not found. Using default value - 0"
-            version_number="0"
-          else
-            echo "✅ Found version number: $version_number"
-          fi
-
-          echo "version_number=$version_number" >> "$GITHUB_OUTPUT"
-          echo "version_name=$version_name" >> "$GITHUB_OUTPUT"
-
-          tag_name="v$version_name-$_APP_NAME_SUFFIX" # e.g. v2025.6.0-bwpm
-          echo "🔖 New tag name: $tag_name"
-          echo "tag_name=$tag_name" >> "$GITHUB_OUTPUT"
-
-          last_release_tag=$(git tag -l --sort=-authordate | grep "$_APP_NAME_SUFFIX" | head -n 1)
-          echo "🔖 Last release tag: $last_release_tag"
-          echo "last_release_tag=$last_release_tag" >> "$GITHUB_OUTPUT"
+          echo "release_branch=$release_branch" >> $GITHUB_OUTPUT

      - name: Download artifacts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
        run: |
-          gh run download "$ARTIFACT_RUN_ID" -D "$ARTIFACTS_PATH"
-          file_count=$(find "$ARTIFACTS_PATH" -type f | wc -l)
+          gh run download $ARTIFACT_RUN_ID -D $ARTIFACTS_PATH
+          file_count=$(find $ARTIFACTS_PATH -type f | wc -l)
          echo "Downloaded $file_count file(s)."
          if [ "$file_count" -gt 0 ]; then
            echo "Downloaded files:"
-            find "$ARTIFACTS_PATH" -type f
+            find $ARTIFACTS_PATH -type f
          fi

-          # Files that won't be included in any release
-          files_to_remove=(
-            "com.x8bit.bitwarden.aab"
-            "com.x8bit.bitwarden.aab-sha256.txt"
-
-            "com.x8bit.bitwarden.beta.apk"
-            "com.x8bit.bitwarden.beta.apk-sha256.txt"
-            "com.x8bit.bitwarden.beta.aab"
-            "com.x8bit.bitwarden.beta.aab-sha256.txt"
-
-            "com.x8bit.bitwarden.beta-fdroid.apk"
-            "com.x8bit.bitwarden.beta-fdroid.apk-sha256.txt"
-
-            "com.x8bit.bitwarden.dev.apk"
-            "com.x8bit.bitwarden.dev.apk-sha256.txt"
-
-            "com.bitwarden.authenticator.aab"
-            "authenticator-android-aab-sha256.txt"
-          )
-
-          for file in "${files_to_remove[@]}"; do
-            find "$ARTIFACTS_PATH" -name "$file" -type f -delete
-          done
-          echo "🔖 Removed internal artifacts."
-          echo ""
-          echo "🔖 Files to be included in the release:"
-          find "$ARTIFACTS_PATH" -type f
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "JIRA-API-EMAIL,JIRA-API-TOKEN"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Get product release notes
-        id: get_release_notes
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _RELEASE_TICKET_ID: ${{ inputs.release-ticket-id }}
-          _JIRA_API_EMAIL: ${{ steps.get-kv-secrets.outputs.JIRA-API-EMAIL }}
-          _JIRA_API_TOKEN: ${{ steps.get-kv-secrets.outputs.JIRA-API-TOKEN }}
-        run: |
-          echo "Getting product release notes"
-          product_release_notes=$(python3 .github/scripts/jira-get-release-notes/jira_release_notes.py "$_RELEASE_TICKET_ID" "$_JIRA_API_EMAIL" "$_JIRA_API_TOKEN")
-
-          if [[ -z "$product_release_notes" || $product_release_notes == "Error checking"* ]]; then
-            echo "::warning::Failed to fetch release notes from Jira. Output: $product_release_notes"
-            product_release_notes="<insert product release notes here>"
-          else
-            echo "✅ Product release notes:"
-            echo "$product_release_notes"
-          fi
-
-          echo "$product_release_notes" > product_release_notes.txt
-
      - name: Create Release
        id: create_release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          _APP_NAME: ${{ steps.get_release_branch.outputs.app_name }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _VERSION_NUMBER: ${{ steps.get_release_info.outputs.version_number }}
-          _TARGET_COMMIT: ${{ steps.get_release_branch.outputs.release_branch }}
-          _TAG_NAME: ${{ steps.get_release_info.outputs.tag_name }}
-          _LAST_RELEASE_TAG: ${{ steps.get_release_info.outputs.last_release_tag }}
-        run: |
-          is_latest_release=false
-          if [[ "$_APP_NAME" == "Password Manager" ]]; then
-            is_latest_release=true
-          fi
-
-          echo "⌛️ Creating release for $_APP_NAME $_VERSION_NAME ($_VERSION_NUMBER) on $_TARGET_COMMIT"
-          release_url=$(gh release create "$_TAG_NAME" \
-            --title "$_APP_NAME $_VERSION_NAME ($_VERSION_NUMBER)" \
-            --target "$_TARGET_COMMIT" \
-            --generate-notes \
-            --notes-start-tag "$_LAST_RELEASE_TAG" \
-            --latest=$is_latest_release \
-            --draft \
-            "$ARTIFACTS_PATH/*/*")
-
-          # Extract release tag from URL
-          release_id_from_url=$(echo "$release_url" | sed 's/.*\/tag\///')
-          echo "release_id_from_url=$release_id_from_url" >> "$GITHUB_OUTPUT"
-          echo "url=$release_url" >> "$GITHUB_OUTPUT"
-
-          echo "✅ Release created: $release_url"
-          echo "🔖 Release ID from URL: $release_id_from_url"
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
+        with:
+          tag_name: "v${{ inputs.version-name }}"
+          name: "${{ inputs.version-name }} (${{ inputs.version-number }})"
+          prerelease: ${{ inputs.prerelease }}
+          draft: ${{ inputs.draft }}
+          make_latest: ${{ inputs.make-latest }}
+          target_commitish: ${{ steps.get_release_branch.outputs.release_branch }}
+          generate_release_notes: true
+          files: |
+            artifacts/**/*

      - name: Update Release Description
-        id: update_release_description
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_ID: ${{ steps.create_release.outputs.id }}
+          RELEASE_URL: ${{ steps.create_release.outputs.url }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _RELEASE_ID: ${{ steps.create_release.outputs.release_id_from_url }}
        run: |
-          echo "Getting current release body. Release ID: $_RELEASE_ID"
-          current_body=$(gh release view "$_RELEASE_ID" --json body --jq .body)
+          # Get current release body
+          current_body=$(gh api /repos/${{ github.repository }}/releases/$RELEASE_ID --jq .body)

-          product_release_notes=$(cat product_release_notes.txt)
-
-          # Update release description with product release notes and builds source
-          updated_body="# Overview
-          ${product_release_notes}
-
-          ${current_body}
+          # Append build source to the end
+          updated_body="${current_body}
          **Builds Source:** https://github.com/${{ github.repository }}/actions/runs/$ARTIFACT_RUN_ID"

-          new_release_url=$(gh release edit "$_RELEASE_ID" --notes "$updated_body")
+          # Update release
+          gh api --method PATCH /repos/${{ github.repository }}/releases/$RELEASE_ID \
+            -f body="$updated_body"

-          # draft release links change after editing
-          echo "release_url=$new_release_url" >> "$GITHUB_OUTPUT"
-
-      - name: Add Release Summary
-        env:
-          _RELEASE_TAG: ${{ steps.get_release_info.outputs.tag_name }}
-          _LAST_RELEASE_TAG: ${{ steps.get_release_info.outputs.last_release_tag }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _VERSION_NUMBER: ${{ steps.get_release_info.outputs.version_number }}
-          _RELEASE_BRANCH: ${{ steps.get_release_branch.outputs.release_branch }}
-          _RELEASE_URL: ${{ steps.update_release_description.outputs.release_url }}
-        run: |
-          {
-            echo "# :fish_cake: Release ready at:"
-            echo "$_RELEASE_URL"
-            echo ""
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [[ "$_VERSION_NAME" == "0.0.0" || "$_VERSION_NUMBER" == "0" ]]; then
-            {
-              echo "> [!CAUTION]"
-              echo "> Version name or number wasn't previously found and a default value was used. You'll need to manually update the release Title, Tag and Description, specifically, the \"Full Changelog\" link."
-              echo ""
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-          {
-            echo ":clipboard: Confirm that the defined GitHub Release options are correct:"
-            echo " * :bookmark: New tag name: \`$_RELEASE_TAG\`"
-            echo " * :palm_tree: Target branch: \`$_RELEASE_BRANCH\`"
-            echo " * :ocean: Previous tag set in the description \"Full Changelog\" link: \`$_LAST_RELEASE_TAG\`"
-            echo " * :white_check_mark: Description has automated release notes and they match the commits in the release branch"
-            echo "> [!NOTE]"
-            echo "> Commits directly pushed to branches without a Pull Request won't appear in the automated release notes." 
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "# :rocket: Release ready at:" >> $GITHUB_STEP_SUMMARY
+          echo "$RELEASE_URL" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/publish-github-release-bwa.yml
+++ b/.github/workflows/publish-github-release-bwa.yml
@@ -1,23 +0,0 @@
-name: Publish Authenticator GitHub Release as newest
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 * * * 1-5' # Every hour on the hour on weekdays
-permissions:
-  contents: write
-  id-token: write
-  actions: write
-
-jobs:
-  publish-release-authenticator:
-    name: Publish Authenticator Release
-    uses: bitwarden/gh-actions/.github/workflows/_publish-mobile-github-release.yml@main
-    with:
-      release_name: "Authenticator"
-      workflow_name: "publish-github-release-bwa.yml"
-      credentials_filename: "authenticator_play_store-creds.json"
-      project_type: android
-      check_release_command: >
-        bundle exec fastlane getLatestPlayStoreVersion package_name:com.bitwarden.authenticator track:production
-    secrets: inherit
--- a/.github/workflows/publish-github-release-bwpm.yml
+++ b/.github/workflows/publish-github-release-bwpm.yml
@@ -1,24 +0,0 @@
-name: Publish Password Manager GitHub Release as newest
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 * * * 1-5' # Every hour on the hour on weekdays
-
-permissions:
-  contents: write
-  id-token: write
-  actions: write
-
-jobs:
-  publish-release-password-manager:
-    name: Publish Password Manager Release
-    uses: bitwarden/gh-actions/.github/workflows/_publish-mobile-github-release.yml@main
-    with:
-      release_name: "Password Manager"
-      workflow_name: "publish-github-release-bwpm.yml"
-      credentials_filename: "play_creds.json"
-      project_type: android
-      check_release_command: >
-        bundle exec fastlane getLatestPlayStoreVersion package_name:com.x8bit.bitwarden track:production
-    secrets: inherit
--- a/.github/workflows/publish-store.yml
+++ b/.github/workflows/publish-store.yml
@@ -1,190 +0,0 @@
-name: Publish to Google Play
-run-name:  >
-  ${{ inputs.dry-run && ' (Dry Run)' || '' }}Promoting ${{ inputs.product }} ${{ inputs.version-code }} from ${{ inputs.track-from }} to ${{ inputs.track-target }}
-on:
-  workflow_dispatch:
-    inputs:
-      product:
-        description: "Which app is being released."
-        type: choice
-        options:
-          - Password Manager
-          - Authenticator
-      version-name:
-        description: "Version name to promote to production ex 2025.1.1"
-        type: string
-      version-code:
-        description: "Build number to promote to production."
-        required: true
-        type: string
-      rollout-percentage:
-        description: "Percentage of users who will receive this version update."
-        required: true
-        type: choice
-        options:
-          - 10%
-          - 30%
-          - 50%
-          - 100%
-        default: 10%
-      release-notes:
-        description: "Change notes to be included with this release."
-        type: string
-        default: "Bug fixes."
-        required: true
-      track-from:
-        description: "Track to promote from."
-        type: choice
-        options:
-          - internal
-          - Fastlane Automation Source
-        required: true
-        default: "internal"
-      track-target:
-        description: "Track to promote to."
-        type: choice
-        options:
-          - production
-          - Fastlane Automation Target
-        required: true
-      dry-run:
-        description: "Dry-Run, Run the workflow without publishing to the store"
-        type: boolean
-        default: false
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-permissions:
-  contents: read
-  packages: read
-  id-token: write
-  actions: write
-
-jobs:
-  promote:
-    runs-on: ubuntu-24.04
-    name: Promote build to Production in Play Store
-
-    steps:
-      - name: Log inputs to job summary
-        env:
-          INPUTS: ${{ toJson(inputs) }}
-        run: |
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          }  >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
-        with:
-          bundler-cache: true
-
-      - name: Install Fastlane
-        run: |
-          gem install bundler:2.2.27
-          bundle config path vendor/bundle
-          bundle install --jobs 4 --retry 3
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "PLAY-BETA-KEYSTORE-PASSWORD,PLAY-BETA-KEY-PASSWORD"
-
-      - name: Retrieve secrets
-        env:
-          ACCOUNT_NAME: bitwardenci
-          CONTAINER_NAME: mobile
-        run: |
-          mkdir -p ${{ github.workspace }}/secrets
-          mkdir -p ${{ github.workspace }}/app/src/standardRelease
-
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
-          --name play_creds.json --file ${{ github.workspace }}/secrets/play_creds.json --output none
-
-          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
-          --name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Format Release Notes
-        env:
-          RELEASE_NOTES: ${{ inputs.release-notes }}
-        run: |
-          FORMATTED_MESSAGE="$(echo "$RELEASE_NOTES" | sed 's/  /\n/g')"
-          {
-            echo "RELEASE_NOTES<<EOF"
-            printf '%s\n' "$FORMATTED_MESSAGE"
-            echo "EOF"
-          }  >> "$GITHUB_ENV"
-
-      - name: Promote Play Store version to production
-        env:
-          PLAY_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEYSTORE-PASSWORD }}
-          PLAY_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEY-PASSWORD }}
-          VERSION_CODE_INPUT: ${{ inputs.version-code }}
-          VERSION_NAME: ${{inputs.version-name}}
-          ROLLOUT_PERCENTAGE: ${{ inputs.rollout-percentage }}
-          PRODUCT: ${{ inputs.product }}
-          TRACK_FROM: ${{ inputs.track-from }}
-          TRACK_TARGET: ${{ inputs.track-target }}
-        run: |
-          if [ "$PRODUCT" = "Password Manager" ]; then
-            PACKAGE_NAME="com.x8bit.bitwarden"
-          elif [ "$PRODUCT" = "Authenticator" ]; then
-            PACKAGE_NAME="com.bitwarden.authenticator"
-          else
-            echo "Unsupported product: $PRODUCT"
-            exit 1
-          fi
-
-          VERSION_CODE=$(echo "${VERSION_CODE_INPUT}" | tr -d ',')
-
-          decimal=$(echo "scale=2; ${ROLLOUT_PERCENTAGE/\%/} / 100" | bc)
-
-          bundle exec fastlane updateReleaseNotes \
-            releaseNotes:"$RELEASE_NOTES" \
-            versionCode:"$VERSION_CODE" \
-            packageName:"$PACKAGE_NAME"
-
-          bundle exec fastlane promoteToProduction \
-            versionCode:"$VERSION_CODE" \
-            versionName:"$VERSION_NAME" \
-            rolloutPercentage:"$decimal" \
-            packageName:"$PACKAGE_NAME" \
-            releaseNotes:"$RELEASE_NOTES" \
-            track:"$TRACK_FROM" \
-            trackPromoteTo:"$TRACK_TARGET"
-
-      - name: Enable Publish Github Release Workflow
-        env:
-          PRODUCT: ${{ inputs.product }}
-        run: |
-          if ${{ inputs.dry-run }} ; then
-            gh workflow view publish-github-release-bwpm.yml
-            exit 0
-          fi
-          if [ "$PRODUCT" = "Password Manager" ]; then
-            gh workflow enable publish-github-release-bwpm.yml
-          elif [ "$PRODUCT" = "Authenticator" ]; then
-            gh workflow enable publish-github-release-bwa.yml
-          fi
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -4,14 +4,12 @@ on:
  workflow_dispatch:
    inputs:
      release_type:
-        description: "Release Type"
+        description: 'Release Type'
        required: true
        type: choice
        options:
          - RC
-          - Hotfix Password Manager
-          - Hotfix Authenticator
-          - Test
+          - Hotfix

 jobs:
  create-release-branch:
@@ -19,68 +17,42 @@ jobs:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
-      actions: write
    steps:
      - name: Check out repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
-          persist-credentials: true

-      - name: Create RC or Test Branch
-        id: rc_branch
-        if: inputs.release_type == 'RC' || inputs.release_type == 'Test'
+      - name: Create RC Branch
+        if: inputs.release_type == 'RC'
        env:
-          _TEST_MODE: ${{ inputs.release_type == 'Test' }}
-          _RELEASE_TYPE: ${{ inputs.release_type }}
+          RC_PREFIX_DATE: "true" # replace with input if needed
        run: |
-          current_date=$(date +'%Y.%-m')
-          branch_name="${current_date}-rc${{ github.run_number }}"
-
-          if [ "$_TEST_MODE" = "true" ]; then
-            branch_name="WORKFLOW-TEST-${branch_name}"
+          if [ "$RC_PREFIX_DATE" = "true" ]; then
+            current_date=$(date +'%Y.%m')
+            branch_name="release/${current_date}-rc${{ github.run_number }}"
+          else
+            branch_name="release/rc${{ github.run_number }}"
          fi
-          branch_name="release/${branch_name}"
-
          git switch main
-          git switch -c "$branch_name"
-          git push origin "$branch_name"
-          echo "# :cherry_blossom: ${_RELEASE_TYPE} branch: ${branch_name}" >> "$GITHUB_STEP_SUMMARY"
-          echo "branch_name=$branch_name" >> "$GITHUB_OUTPUT"
+          git switch -c $branch_name
+          git push origin $branch_name
+          echo "# :cherry_blossom: RC branch: ${branch_name}" >> $GITHUB_STEP_SUMMARY

      - name: Create Hotfix Branch
-        id: hotfix_branch
-        if: startsWith(inputs.release_type, 'Hotfix')
-        env:
-          _RELEASE_TYPE: ${{ inputs.release_type }}
+        if: inputs.release_type == 'Hotfix'
        run: |
-          app_codename="bwpm"
-          if [ "$_RELEASE_TYPE" == "Hotfix Authenticator" ]; then
-            app_codename="bwa"
-          fi
-          echo "🌿 app codename: $app_codename"
-
-          latest_tag=$(git tag -l --sort=-creatordate | grep "$app_codename" | head -n 1)
+          latest_tag=$(git tag -l --sort=-creatordate | head -n 1)
          if [ -z "$latest_tag" ]; then
            echo "::error::No tags found in the repository"
            exit 1
          fi
          branch_name="release/hotfix-${latest_tag}"
          echo "🌿 branch name: $branch_name"
-          echo "branch_name=$branch_name" >> "$GITHUB_OUTPUT"
          if git show-ref --verify --quiet "refs/remotes/origin/$branch_name"; then
-            echo "# :fire: :warning: Hotfix branch already exists: ${branch_name}" >> "$GITHUB_STEP_SUMMARY"
+            echo "# :fire: :warning: Hotfix branch already exists: ${branch_name}" >> $GITHUB_STEP_SUMMARY
            exit 0
          fi
-          git switch -c "$branch_name" "$latest_tag"
-          git push origin "$branch_name"
-          echo "# :fire: Hotfix branch: ${branch_name}" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Trigger CI Workflows
-        env:
-          GH_TOKEN: ${{ github.token }}
-          _BRANCH_NAME: ${{ steps.rc_branch.outputs.branch_name || steps.hotfix_branch.outputs.branch_name }}
-        run: |
-          echo "🌿 branch name: $_BRANCH_NAME"
-          gh workflow run build.yml --ref "$_BRANCH_NAME" -f distribute-to-firebase=true -f publish-to-play-store=true
-          gh workflow run build-authenticator.yml --ref "$_BRANCH_NAME" -f distribute-to-firebase=true -f publish-to-play-store=true
+          git switch -c $branch_name $latest_tag
+          git push origin $branch_name
+          echo "# :fire: Hotfix branch: ${branch_name}" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/scan-authenticator.yml
+++ b/.github/workflows/scan-authenticator.yml
@@ -0,0 +1,76 @@
+name: Scan Authenticator
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+      - "rc"
+      - "hotfix-rc"
+  pull_request_target:
+    types: [opened, synchronize]
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  sast:
+    name: SAST scan
+    runs-on: ubuntu-24.04
+    needs: check-run
+    permissions:
+      contents: read
+      pull-requests: write
+      security-events: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@184bf2f64f55d1c93fd6636d539edf274703e434 # 2.0.41
+        env:
+          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path . ${{ env.INCREMENTAL }}
+
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
+        with:
+          sarif_file: cx_result.sarif
+
+  quality:
+    name: Quality scan
+    runs-on: ubuntu-24.04
+    needs: check-run
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203 # v4.2.1
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=${{ github.repository_owner }}
+            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
--- a/.github/workflows/scan-ci.yml
+++ b/.github/workflows/scan-ci.yml
@@ -6,30 +6,56 @@ on:
    branches:
      - "main"

-permissions: {}
-
 jobs:
  sast:
-    name: Checkmarx
-    uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    name: SAST scan
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
-      pull-requests: write
      security-events: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@184bf2f64f55d1c93fd6636d539edf274703e434 # 2.0.41
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path .
+
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        with:
+          sarif_file: cx_result.sarif

  quality:
-    name: Sonar
-    uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    name: Quality scan
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
-      pull-requests: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Scan with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203 # v4.2.1
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=${{ github.repository_owner }}
+            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -2,47 +2,70 @@ name: Scan Pull Requests

 on:
  workflow_dispatch:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches-ignore:
-      - main
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
-
-permissions: {}
+  pull_request_target:
+    types: [opened, synchronize]

 jobs:
  check-run:
    name: Check PR run
    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-    permissions:
-      contents: read

  sast:
-    name: Checkmarx
-    uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main
+    name: SAST scan
+    runs-on: ubuntu-24.04
    needs: check-run
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@184bf2f64f55d1c93fd6636d539edf274703e434 # 2.0.41
+        env:
+          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path . ${{ env.INCREMENTAL }}
+
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        with:
+          sarif_file: cx_result.sarif

  quality:
-    name: Sonar
-    uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main
+    name: Quality scan
+    runs-on: ubuntu-24.04
    needs: check-run
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    permissions:
      contents: read
      pull-requests: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203 # v4.2.1
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=${{ github.repository_owner }}
+            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
--- a/.github/workflows/sdlc-sdk-update.yml
+++ b/.github/workflows/sdlc-sdk-update.yml
@@ -1,230 +0,0 @@
-name: SDLC / SDK Update
-run-name: "SDK ${{inputs.run-mode == 'Update' && format('Update - {0}', inputs.sdk-version) || format('Test #{0} - {1}', inputs.pr-id, inputs.sdk-version)}}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      run-mode:
-        description: "Run Mode"
-        type: choice
-        options:
-          - Test # used for testing sdk-internal repo PRs
-          - Update # opens a PR in this repo updating the SDK
-        default: Test
-      sdk-package:
-        description: "SDK Package ID"
-        required: true
-        default: "com.bitwarden:sdk-android.dev"
-      sdk-version:
-        description: "SDK Version"
-        required: true
-        default: "1.0.0-2686-km-update-kdf-sdk"
-      pr-id:
-        description: "Pull Request ID"
-
-env:
-  _BOT_NAME: "bw-ghapp[bot]"
-  _BOT_EMAIL: "178206702+bw-ghapp[bot]@users.noreply.github.com"
-
-jobs:
-  update:
-    name: Update and PR
-    if: ${{ inputs.run-mode == 'Update' }}
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-
-    steps:
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Generate GH App token
-        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
-        id: app-token
-        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
-          permission-pull-requests: write
-          permission-actions: read
-          permission-contents: write
-
-      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          fetch-depth: 0
-          persist-credentials: true
-
-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}
-
-      - name: Switch to branch
-        id: switch-branch
-        run: |
-          BRANCH_NAME="sdlc/sdk-update"
-          echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
-
-          if git switch "$BRANCH_NAME"; then
-            echo "✅ Switched to existing branch: $BRANCH_NAME"
-            echo "updating_existing_branch=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "📝 Creating new branch: $BRANCH_NAME"
-            git switch -c "$BRANCH_NAME"
-            echo "updating_existing_branch=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Prevent updating the branch when the last committer isn't the bot
-        if: ${{ steps.switch-branch.outputs.updating_existing_branch == 'true' }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          _BRANCH_NAME: ${{ steps.switch-branch.outputs.branch_name }}
-        run: |
-          LATEST_COMMIT_AUTHOR=$(git log -1 --format='%ae' "$_BRANCH_NAME")
-
-          echo "Latest commit author in branch ($_BRANCH_NAME): $LATEST_COMMIT_AUTHOR"
-          echo "Expected bot email: $_BOT_EMAIL"
-
-          if [ "$LATEST_COMMIT_AUTHOR" != "$_BOT_EMAIL" ]; then
-            echo "::error::Branch $_BRANCH_NAME has a commit not made by the bot." \
-              "This indicates manual changes have been made to the branch," \
-              "PR has to be merged or closed before running this workflow again."
-            echo "👀 Fetching existing PR..."
-            gh pr list --head "$_BRANCH_NAME" --base main --state open --json number --jq '.[0].number // empty'
-            EXISTING_PR=$(gh pr list --head "$_BRANCH_NAME" --base main --state open --json number --jq '.[0].number // empty')
-            if [ -z "$EXISTING_PR" ]; then
-              echo "::error::Couldn't find an existing PR for branch $_BRANCH_NAME."
-              exit 1
-            fi
-            PR_URL="https://github.com/${{ github.repository }}/pull/$EXISTING_PR"
-            echo "## ❌ Merge or close: $PR_URL" >> "$GITHUB_STEP_SUMMARY"
-            exit 1
-          fi
-
-          echo "✅ Branch tip commit was made by the bot. Safe to proceed."
-
-      # Using main to retrieve the changelog on consecutive updates of the same PR.
-      - name: Get current SDK version from main branch
-        id: get-current-sdk
-        run: |
-          git show origin/main:gradle/libs.versions.toml
-          SDK_VERSION=$(git show origin/main:gradle/libs.versions.toml | grep "bitwardenSdk =" | cut -d'"' -f2)
-          if [ -z "$SDK_VERSION" ]; then
-            echo "::error::Failed to get current SDK version from main branch."
-            exit 1
-          fi
-          GIT_REF=$(echo "$SDK_VERSION" | cut -d'-' -f3-) # handles both commit hashes and branch names
-          echo "Current SDK version (from main): $SDK_VERSION"
-          echo "Current SDK git ref: $GIT_REF"
-          echo "version=$SDK_VERSION" >> "$GITHUB_OUTPUT"
-          echo "git_ref=$GIT_REF" >> "$GITHUB_OUTPUT"
-
-      - name: Update SDK Version
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-        run: |
-          ./scripts/update-sdk-version.sh "$_SDK_PACKAGE" "$_SDK_VERSION"
-
-      - name: Create branch and commit
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-          _BRANCH_NAME: ${{ steps.switch-branch.outputs.branch_name }}
-        run: |
-          echo "👀 Committing SDK version update..."
-
-          git config user.name "$_BOT_NAME"
-          git config user.email "$_BOT_EMAIL"
-
-          git add gradle/libs.versions.toml
-          git commit -m "SDK Update - $_SDK_PACKAGE $_SDK_VERSION"
-          git push origin "$_BRANCH_NAME"
-
-      - name: Create or Update Pull Request
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          _BRANCH_NAME: ${{ steps.switch-branch.outputs.branch_name }}
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-          _OLD_SDK_VERSION: ${{ steps.get-current-sdk.outputs.version }}
-          _OLD_SDK_GIT_REF: ${{ steps.get-current-sdk.outputs.git_ref }}
-        run: |
-          NEW_SDK_GIT_REF=$(echo "$_SDK_VERSION" | cut -d'-' -f3-)
-          CHANGELOG=$(./scripts/get-repo-changelog.sh "bitwarden/sdk-internal" "$_OLD_SDK_GIT_REF" "$NEW_SDK_GIT_REF")
-          PR_BODY="Updates the SDK version from \`$_OLD_SDK_VERSION\` to \`$_SDK_PACKAGE $_SDK_VERSION\`
-
-          ## What's Changed
-
-          $CHANGELOG"
-
-          EXISTING_PR=$(gh pr list --head "$_BRANCH_NAME" --base main --state open --json number --jq '.[0].number // empty')
-
-          if [ -n "$EXISTING_PR" ]; then
-            echo "🔄 Updating existing PR #$EXISTING_PR..."
-            echo -e "$PR_BODY" | gh pr edit "$EXISTING_PR" \
-              --title "Update SDK to $_SDK_VERSION" \
-              --body-file -
-            PR_URL="https://github.com/${{ github.repository }}/pull/$EXISTING_PR"
-            echo "## ✅ Updated PR: $PR_URL" >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "📝 Creating new PR..."
-            PR_URL=$(echo -e "$PR_BODY" | gh pr create \
-              --title "Update SDK to $_SDK_VERSION" \
-              --body-file - \
-              --base main \
-              --head "$_BRANCH_NAME" \
-              --label "automated-pr" \
-              --label "t:ci")
-            echo "## 🚀 Created PR: $PR_URL" >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-  test:
-    name: Test Update
-    if: ${{ inputs.run-mode == 'Test' }}
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-
-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}
-
-      - name: Setup Android Build
-        uses: ./.github/actions/setup-android-build
-
-      - name: Update SDK Version
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-        run: |
-          ./scripts/update-sdk-version.sh "$_SDK_PACKAGE" "$_SDK_VERSION"
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Used in settings.gradle.kts to download the SDK from GitHub Maven Packages
-        run: |
-          ./gradlew assembleDebug --warn
--- a/.github/workflows/test-authenticator.yml
+++ b/.github/workflows/test-authenticator.yml
@@ -0,0 +1,82 @@
+name: Test Authenticator
+
+on:
+  push:
+    branches:
+      - "main"
+      - "rc"
+      - "hotfix-rc"
+  pull_request_target:
+    types: [opened, synchronize]
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  JAVA_VERSION: 17
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  test:
+    name: Test
+    runs-on: ubuntu-24.04
+    needs: check-run
+    permissions:
+      contents: read
+      packages: read
+      pull-requests: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
+
+      - name: Cache Gradle files
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-v2-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-v2-
+
+      - name: Cache build output
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        with:
+          path: |
+            ${{ github.workspace }}/build-cache
+          key: ${{ runner.os }}-build-cache-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-build-
+
+      - name: Configure Ruby
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
+        with:
+          bundler-cache: true
+
+      - name: Configure JDK
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
+        with:
+          distribution: "temurin"
+          java-version: ${{ env.JAVA_VERSION }}
+
+      - name: Install Fastlane
+        run: |
+          gem install bundler:2.2.27
+          bundle config path vendor/bundle
+          bundle install --jobs 4 --retry 3
+
+      - name: Build and test Authenticator
+        run: |
+          bundle exec fastlane checkAuthenticator
+
+      - name: Upload to codecov.io
+        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+        with:
+          files: authenticator/build/reports/kover/reportDebug.xml
--- a/.github/workflows/test-device.yml
+++ b/.github/workflows/test-device.yml
@@ -1,16 +0,0 @@
-name: Test Device
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test Device
-    runs-on: ubuntu-24.04
-
-    steps:
-    - name: Placeholder step
-      run: echo "Placeholder workflow step"
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,32 +9,30 @@ on:
  pull_request:
    types: [opened, synchronize]
  merge_group:
-    types: [checks_requested]
+    type: [checks_requested]
  workflow_dispatch:

 env:
-  _JAVA_VERSION: 21
+  _JAVA_VERSION: 17
  _GITHUB_ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}

+
 jobs:
  test:
    name: Test
    runs-on: ubuntu-24.04
    permissions:
      packages: read
-      pull-requests: write

    steps:
      - name: Check out repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ~/.gradle/caches
@@ -44,7 +42,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -53,12 +51,12 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@28c4deda893d5a96a6b2d958c5b47fc18d65c9d3 # v1.213.0
        with:
          bundler-cache: true

      - name: Configure JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: ${{ env._JAVA_VERSION }}
@@ -76,42 +74,52 @@ jobs:
          bundle exec fastlane check

      - name: Upload test reports
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: always()
        with:
          name: test-reports
          path: |
-            build/reports/kover/reportMergedCoverage.xml
            app/build/reports/tests/
-            authenticator/build/reports/tests/
-            authenticatorbridge/build/reports/tests/
-            core/build/reports/tests/
-            data/build/reports/tests/
-            network/build/reports/tests/
-            ui/build/reports/tests/
+            app/build/reports/kover/reportStandardDebug.xml
+
+  report:
+    name: Process Test Reports
+    needs: test
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    if: success()
+
+    steps:
+      - name: Download test artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        with:
+          name: test-reports

      - name: Upload to codecov.io
        id: upload-to-codecov
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        continue-on-error: true
        with:
          os: linux
-          files: build/reports/kover/reportMergedCoverage.xml
+          files: kover/reportStandardDebug.xml
          fail_ci_if_error: true
-          disable_search: true

      - name: Comment PR if tests failed
        if: steps.upload-to-codecov.outcome == 'failure' && (github.event_name == 'push' || github.event_name == 'pull_request')
        env:
-          PR_NUMBER: ${{ github.event.number }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RUN_ACTOR: ${{ github.triggering_actor }}
+            PR_NUMBER: ${{ github.event.number }}
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            RUN_ACTOR: ${{ github.triggering_actor }}
        run: |
-          echo "> [!WARNING]" >> "$GITHUB_STEP_SUMMARY"
-          echo "> Uploading code coverage report failed. Please check the \"Upload to codecov.io\" step of \"Process Test Reports\" job for more details." >> "$GITHUB_STEP_SUMMARY"
+          echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+          echo "> Uploading code coverage report failed. Please check the \"Upload to codecov.io\" step of \"Process Test Reports\" job for more details." >> $GITHUB_STEP_SUMMARY

-          if [ -n "$PR_NUMBER" ]; then
+          if [ ! -z "$PR_NUMBER" ]; then
            message=$'> [!WARNING]\n> @'$RUN_ACTOR' Uploading code coverage report failed. Please check the "Upload to codecov.io" step of [Process Test Reports job]('$_GITHUB_ACTION_RUN_URL') for more details.'
-            gh pr comment --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" --body "$message"
+            gh pr comment --repo $GITHUB_REPOSITORY $PR_NUMBER --body "$message"
          fi
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,5 +0,0 @@
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        bitwarden/gh-actions/*: ref-pin
--- a/.gitignore
+++ b/.gitignore
@@ -3,13 +3,6 @@
 fastlane/report.xml
 fastlane/README.md

-# Ruby / Bundler
-.bundle/
-vendor/
-
-# Backup files
-*.bak
-
 # General
 .DS_Store
 Thumbs.db
@@ -36,9 +29,8 @@ user.properties
 /app/src/standardRelease/google-services.json
 /authenticator/src/google-services.json

-# Python
-.python-version
+# python
 __pycache__/
-
-# Generated by .github/scripts/validate-json/validate-json.py
-duplicates.txt
+*.py[cod]
+*$py.class
+*.so
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.2
+3.3.1
--- a/9
+++ b/9
@@ -7,12 +7,3 @@ gem 'time'

 plugins_path = File.join(File.dirname(__FILE__), 'fastlane', 'Pluginfile')
 eval_gemfile(plugins_path) if File.exist?(plugins_path)
-
-# Since ruby 3.4.0 these are not included in the standard library
-gem 'abbrev'
-gem 'logger'
-gem 'mutex_m'
-gem 'csv'
-
-# Starting with Ruby 3.5.0, these are not included in the standard library
-gem 'ostruct'
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -5,42 +5,36 @@ GEM
      base64
      nkf
      rexml
-    abbrev (0.1.2)
    addressable (2.8.7)
      public_suffix (>= 2.0.2, < 7.0)
    artifactory (3.0.17)
    atomos (0.1.3)
-    aws-eventstream (1.4.0)
-    aws-partitions (1.1172.0)
-    aws-sdk-core (3.233.0)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.1040.0)
+    aws-sdk-core (3.216.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
-      base64
-      bigdecimal
      jmespath (~> 1, >= 1.6.1)
-      logger
-    aws-sdk-kms (1.113.0)
-      aws-sdk-core (~> 3, >= 3.231.0)
+    aws-sdk-kms (1.97.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.199.1)
-      aws-sdk-core (~> 3, >= 3.231.0)
+    aws-sdk-s3 (1.178.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.12.1)
+    aws-sigv4 (1.11.0)
      aws-eventstream (~> 1, >= 1.0.2)
    babosa (1.0.4)
-    base64 (0.3.0)
-    bigdecimal (3.3.1)
+    base64 (0.2.0)
    claide (1.1.0)
    colored (1.2)
    colored2 (3.1.2)
    commander (4.6.0)
      highline (~> 2.0.0)
-    csv (3.3.5)
    date (3.4.1)
    declarative (0.0.20)
-    digest-crc (0.7.0)
+    digest-crc (0.6.5)
      rake (>= 12.0.0, < 14.0.0)
    domain_name (0.6.20240107)
    dotenv (2.8.1)
@@ -62,10 +56,10 @@ GEM
      faraday (>= 0.8.0)
      http-cookie (~> 1.0.0)
    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.1)
+    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
-    faraday-multipart (1.1.1)
+    faraday-multipart (1.1.0)
      multipart-post (~> 2.0)
    faraday-net_http (1.0.2)
    faraday-net_http_persistent (1.2.0)
@@ -75,7 +69,7 @@ GEM
    faraday_middleware (1.2.1)
      faraday (~> 1.0)
    fastimage (2.4.0)
-    fastlane (2.228.0)
+    fastlane (2.226.0)
      CFPropertyList (>= 2.3, < 4.0.0)
      addressable (>= 2.8, < 3.0.0)
      artifactory (~> 3.0)
@@ -115,9 +109,9 @@ GEM
      tty-spinner (>= 0.8.0, < 1.0.0)
      word_wrap (~> 1.0.0)
      xcodeproj (>= 1.13.0, < 2.0.0)
-      xcpretty (~> 0.4.1)
+      xcpretty (~> 0.4.0)
      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
-    fastlane-plugin-firebase_app_distribution (0.10.1)
+    fastlane-plugin-firebase_app_distribution (0.10.0)
      google-apis-firebaseappdistribution_v1 (~> 0.3.0)
      google-apis-firebaseappdistribution_v1alpha (~> 0.2.0)
    fastlane-sirp (1.0.0)
@@ -143,12 +137,12 @@ GEM
      google-apis-core (>= 0.11.0, < 2.a)
    google-apis-storage_v1 (0.31.0)
      google-apis-core (>= 0.11.0, < 2.a)
-    google-cloud-core (1.8.0)
+    google-cloud-core (1.7.1)
      google-cloud-env (>= 1.0, < 3.a)
      google-cloud-errors (~> 1.0)
    google-cloud-env (1.6.0)
      faraday (>= 0.17.3, < 3.0)
-    google-cloud-errors (1.5.0)
+    google-cloud-errors (1.4.0)
    google-cloud-storage (1.47.0)
      addressable (~> 2.8)
      digest-crc (~> 0.4)
@@ -166,41 +160,37 @@ GEM
    highline (2.0.3)
    http-cookie (1.0.8)
      domain_name (~> 0.5)
-    httpclient (2.9.0)
-      mutex_m
+    httpclient (2.8.3)
    jmespath (1.6.2)
-    json (2.15.1)
-    jwt (2.10.2)
+    json (2.9.1)
+    jwt (2.10.1)
      base64
-    logger (1.7.0)
    mini_magick (4.13.2)
    mini_mime (1.1.5)
-    multi_json (1.17.0)
+    multi_json (1.15.0)
    multipart-post (2.4.1)
-    mutex_m (0.3.0)
    nanaimo (0.4.0)
-    naturally (2.3.0)
+    naturally (2.2.1)
    nkf (0.2.0)
    optparse (0.6.0)
    os (1.1.4)
-    ostruct (0.6.3)
    plist (3.7.2)
-    public_suffix (6.0.2)
-    rake (13.3.0)
+    public_suffix (6.0.1)
+    rake (13.2.1)
    representable (3.2.0)
      declarative (< 0.1.0)
      trailblazer-option (>= 0.1.1, < 0.2.0)
      uber (< 0.2.0)
    retriable (3.1.2)
-    rexml (3.4.4)
+    rexml (3.4.0)
    rouge (3.28.0)
    ruby2_keywords (0.0.5)
    rubyzip (2.4.1)
    security (0.1.5)
-    signet (0.21.0)
+    signet (0.19.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 4.0)
+      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
    simctl (1.6.10)
      CFPropertyList
@@ -226,7 +216,7 @@ GEM
      colored2 (~> 3.1)
      nanaimo (~> 0.4.0)
      rexml (>= 3.3.6, < 4.0)
-    xcpretty (0.4.1)
+    xcpretty (0.4.0)
      rouge (~> 3.28.0)
    xcpretty-travis-formatter (1.0.1)
      xcpretty (~> 0.2, >= 0.0.7)
@@ -235,17 +225,12 @@ PLATFORMS
  ruby

 DEPENDENCIES
-  abbrev
-  csv
  fastlane
  fastlane-plugin-firebase_app_distribution
-  logger
-  mutex_m
-  ostruct
  time

 RUBY VERSION
-   ruby 3.4.2p28
+   ruby 3.3.1p55

 BUNDLED WITH
-   2.6.9
+   2.5.9
--- a/README.md
+++ b/README.md
@@ -4,7 +4,6 @@

 - [Compatibility](#compatibility)
 - [Setup](#setup)
- [Theme](#theme)
 - [Dependencies](#dependencies)

 ## Compatibility
@@ -16,6 +15,7 @@

 ## Setup

+
 1. Clone the repository:

    ```sh
@@ -52,77 +52,12 @@

    Please avoid mixing formatting and logical changes in the same commit/PR. When possible, fix any large formatting issues in a separate PR before opening one to make logical changes to the same code. This helps others focus on the meaningful code changes when reviewing the code.

-4. Setup JDK `Version` `21`:
-
-    - Navigate to `Preferences > Build, Execution, Deployment > Build Tools > Gradle`.
-    - Hit the selected Gradle JDK next to `Gradle JDK:`.
-    - Select a `21.x` version or hit `Download JDK...` if not present.
-    - Select `Version` `21`.
-    - Select your preferred `Vendor`.
-    - Hit `Download`.
-    - Hit `Apply`.
-
-5. Setup `detekt` pre-commit hook (optional):
-
-Run the following script from the root of the repository to install the hook. This will overwrite any existing pre-commit hook if present.
-
-```shell
-echo "Writing detekt pre-commit hook..."
-cat << 'EOL' > .git/hooks/pre-commit
-#!/usr/bin/env bash
-
-echo "Running detekt check..."
-OUTPUT="/tmp/detekt-$(date +%s)"
-./gradlew -Pprecommit=true detekt > $OUTPUT
-EXIT_CODE=$?
-if [ $EXIT_CODE -ne 0 ]; then
-  cat $OUTPUT
-  rm $OUTPUT
-  echo "***********************************************"
-  echo "                 detekt failed                 "
-  echo " Please fix the above issues before committing "
-  echo "***********************************************"
-  exit $EXIT_CODE
-fi
-rm $OUTPUT
-EOL
-echo "detekt pre-commit hook written to .git/hooks/pre-commit"
-echo "Making the hook executable"
-chmod +x .git/hooks/pre-commit
-
-echo "detekt pre-commit hook installed successfully to .git/hooks/pre-commit"
-```
-
-## Theme
-
-### Icons & Illustrations
-
-The app supports light mode, dark mode and dynamic colors. Most icons in the app will display correctly using tinting but multi-tonal icons and illustrations require extra processing in order to be displayed properly with dynamic colors.
-
-All illustrations and multi-tonal icons require the svg paths to be tagged with the `name` attribute in order for each individual path to be tinted the appropriate color. Any untagged path will not be tinted and the resulting image will be incorrect.
-
-The supported tags are as follows:
-
-* outline
-* primary
-* secondary
-* tertiary
-* accent
-* logo
-* navigation
-* navigationActiveAccent
-
 ## Dependencies

 ### Application Dependencies

 The following is a list of all third-party dependencies included as part of the application beyond the standard Android SDK.

- **AndroidX Activity**
-    - https://developer.android.com/jetpack/androidx/releases/activity
-    - Purpose: Allows access composable APIs built on top of Activity.
-    - License: Apache 2.0
-
 - **AndroidX Appcompat**
    - https://developer.android.com/jetpack/androidx/releases/appcompat
    - Purpose: Allows access to new APIs on older API versions.
@@ -143,7 +78,7 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: Displays webpages with the user's default browser.
    - License: Apache 2.0

- **AndroidX Camera**
+- **AndroidX CameraX Camera2**
    - https://developer.android.com/jetpack/androidx/releases/camera
    - Purpose: Display and capture images for barcode scanning.
    - License: Apache 2.0
@@ -153,9 +88,9 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: A Kotlin-based declarative UI framework.
    - License: Apache 2.0

- **AndroidX Core**
+- **AndroidX Core SplashScreen**
    - https://developer.android.com/jetpack/androidx/releases/core
-    - Purpose: Backwards compatible platform features and APIs.
+    - Purpose: Backwards compatible SplashScreen API implementation.
    - License: Apache 2.0

 - **AndroidX Credentials**
@@ -168,11 +103,6 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: Lifecycle aware components and tooling.
    - License: Apache 2.0

- **AndroidX Navigation**
-    - https://developer.android.com/jetpack/androidx/releases/navigation
-    - Purpose: Provides a consistent API for navigating between Android components.
-    - License: Apache 2.0
-
 - **AndroidX Room**
    - https://developer.android.com/jetpack/androidx/releases/room
    - Purpose: A convenient SQLite-based persistence layer for Android.
@@ -193,6 +123,21 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: Dependency injection framework.
    - License: Apache 2.0

+- **Firebase Cloud Messaging**
+    - https://github.com/firebase/firebase-android-sdk
+    - Purpose: Allows for push notification support. (**NOTE:** This dependency is not included in builds distributed via F-Droid.)
+    - License: Apache 2.0
+
+- **Firebase Crashlytics**
+    - https://github.com/firebase/firebase-android-sdk
+    - Purpose: SDK for crash and non-fatal error reporting. (**NOTE:** This dependency is not included in builds distributed via F-Droid.)
+    - License: Apache 2.0
+  
+- **Google Play Reviews**
+  - https://developer.android.com/reference/com/google/android/play/core/release-notes
+  - Purpose: On standard builds provide an interface to add a review for the password manager application in Google Play.
+  - License: Apache 2.0
+
 - **Glide**
    - https://github.com/bumptech/glide
    - Purpose: Image loading and caching.
@@ -213,6 +158,11 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: JSON serialization library for Kotlin.
    - License: Apache 2.0

+- **kotlinx.serialization converter**
+    - https://github.com/square/retrofit/tree/trunk/retrofit-converters/kotlinx-serialization
+    - Purpose: Converter for Retrofit 2 and kotlinx.serialization.
+    - License: Apache 2.0
+
 - **OkHttp 3**
    - https://github.com/square/okhttp
    - Purpose: An HTTP client used by the library to intercept and log traffic.
@@ -228,28 +178,16 @@ The following is a list of all third-party dependencies included as part of the
    - Purpose: Extensible logging library for Android.
    - License: Apache 2.0

+- **zxcvbn4j**
+    - https://github.com/nulab/zxcvbn4j
+    - Purpose: Password strength estimation.
+    - License: MIT
+
 - **ZXing**
    - https://github.com/zxing/zxing
    - Purpose: Barcode scanning and generation.
    - License: Apache 2.0

-The following is an additional list of third-party dependencies that are only included in the non-F-Droid build variants of the application.
-
- **Firebase Cloud Messaging**
-    - https://github.com/firebase/firebase-android-sdk
-    - Purpose: Allows for push notification support.
-    - License: Apache 2.0
-
- **Firebase Crashlytics**
-    - https://github.com/firebase/firebase-android-sdk
-    - Purpose: SDK for crash and non-fatal error reporting.
-    - License: Apache 2.0
-
- **Google Play Reviews**
-    - https://developer.android.com/reference/com/google/android/play/core/release-notes
-    - Purpose: On standard builds provide an interface to add a review for the password manager application in Google Play.
-    - License: Apache 2.0
-
 ### Development Environment Dependencies

 The following is a list of additional third-party dependencies used as part of the local development environment. This includes test-related artifacts as well as tools related to code quality and linting. These are not present in the final packaged application.
--- a/annotation/.gitignore
+++ b/annotation/.gitignore
@@ -1 +0,0 @@
-/build
--- a/annotation/build.gradle.kts
+++ b/annotation/build.gradle.kts
@@ -1,42 +0,0 @@
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-
-plugins {
-    alias(libs.plugins.android.library)
-    alias(libs.plugins.kotlin.android)
-}
-
-android {
-    namespace = "com.bitwarden.annotation"
-    compileSdk = libs.versions.compileSdk.get().toInt()
-
-    defaultConfig {
-        minSdk = libs.versions.minSdkBwa.get().toInt()
-
-        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-        consumerProguardFiles("consumer-rules.pro")
-    }
-
-    buildTypes {
-        release {
-            isMinifyEnabled = false
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro",
-            )
-        }
-    }
-    compileOptions {
-        sourceCompatibility(libs.versions.jvmTarget.get())
-        targetCompatibility(libs.versions.jvmTarget.get())
-    }
-    @Suppress("UnstableApiUsage")
-    testFixtures {
-        enable = true
-    }
-}
-
-kotlin {
-    compilerOptions {
-        jvmTarget = JvmTarget.fromTarget(libs.versions.jvmTarget.get())
-    }
-}
--- a/annotation/src/main/kotlin/com/bitwarden/annotation/OmitFromCoverage.kt
+++ b/annotation/src/main/kotlin/com/bitwarden/annotation/OmitFromCoverage.kt
@@ -1,13 +0,0 @@
-package com.bitwarden.annotation
-
-/**
- * Used to omit the annotated class from test coverage reporting. This should be used sparingly and
- * is intended for non-testable classes that are placed in packages along with testable ones.
- */
-@Target(
-    AnnotationTarget.CLASS,
-    AnnotationTarget.FILE,
-    AnnotationTarget.FUNCTION,
-)
-@Retention(AnnotationRetention.BINARY)
-annotation class OmitFromCoverage
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -10,17 +10,19 @@ import java.util.Properties

 plugins {
    alias(libs.plugins.android.application)
-    alias(libs.plugins.androidx.room)
    // Crashlytics is enabled for all builds initially but removed for FDroid builds in gradle and
    // standardDebug builds in the merged manifest.
    alias(libs.plugins.crashlytics)
+    alias(libs.plugins.detekt)
    alias(libs.plugins.hilt)
    alias(libs.plugins.kotlin.android)
    alias(libs.plugins.kotlin.compose.compiler)
    alias(libs.plugins.kotlin.parcelize)
    alias(libs.plugins.kotlin.serialization)
+    alias(libs.plugins.kotlinx.kover)
    alias(libs.plugins.ksp)
    alias(libs.plugins.google.services)
+    alias(libs.plugins.sonarqube)
 }

 /**
@@ -47,32 +49,26 @@ android {
    namespace = "com.x8bit.bitwarden"
    compileSdk = libs.versions.compileSdk.get().toInt()

-    room {
-        schemaDirectory("$projectDir/schemas")
-    }
-
    defaultConfig {
        applicationId = "com.x8bit.bitwarden"
        minSdk = libs.versions.minSdk.get().toInt()
        targetSdk = libs.versions.targetSdk.get().toInt()
-        versionCode = libs.versions.appVersionCode.get().toInt()
-        versionName = libs.versions.appVersionName.get()
+        versionCode = 1
+        versionName = "2024.9.0"
+
+        setProperty("archivesBaseName", "com.x8bit.bitwarden")
+
+        ksp {
+            // The location in which the generated Room Database Schemas will be stored in the repo.
+            arg("room.schemaLocation", "$projectDir/schemas")
+        }

        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"

-        // Set the base archive name for publishing purposes. This is used to derive the APK and AAB
-        // artifact names when uploading to Firebase and Play Store.
-        base.archivesName = "com.x8bit.bitwarden"
-
        buildConfigField(
            type = "String",
            name = "CI_INFO",
-            value = "${ciProperties.getOrDefault("ci.info", "\"\uD83D\uDCBB local\"")}",
-        )
-        buildConfigField(
-            type = "String",
-            name = "SDK_VERSION",
-            value = "\"${libs.versions.bitwardenSdk.get()}\"",
+            value = "${ciProperties.getOrDefault("ci.info", "\"local\"")}"
        )
    }

@@ -106,11 +102,9 @@ android {
            applicationIdSuffix = ".beta"
            isDebuggable = false
            isMinifyEnabled = true
-            isShrinkResources = true
-            matchingFallbacks += listOf("release")
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro",
+                "proguard-rules.pro"
            )

            buildConfigField(type = "boolean", name = "HAS_DEBUG_MENU", value = "false")
@@ -119,10 +113,9 @@ android {
        release {
            isDebuggable = false
            isMinifyEnabled = true
-            isShrinkResources = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro",
+                "proguard-rules.pro"
            )

            buildConfigField(type = "boolean", name = "HAS_DEBUG_MENU", value = "false")
@@ -187,6 +180,7 @@ android {
            excludes += "/META-INF/{AL2.0,LGPL2.1}"
        }
    }
+    @Suppress("UnstableApiUsage")
    testOptions {
        // Required for Robolectric
        unitTests.isIncludeAndroidResources = true
@@ -202,7 +196,7 @@ android {

 kotlin {
    compilerOptions {
-        jvmTarget = JvmTarget.fromTarget(libs.versions.jvmTarget.get())
+        jvmTarget.set(JvmTarget.fromTarget(libs.versions.jvmTarget.get()))
    }
 }

@@ -220,14 +214,7 @@ dependencies {
        add("standardImplementation", dependencyNotation)
    }

-    implementation(files("libs/authenticatorbridge-1.0.1-release.aar"))
-
-    implementation(project(":annotation"))
-    implementation(project(":core"))
-    implementation(project(":cxf"))
-    implementation(project(":data"))
-    implementation(project(":network"))
-    implementation(project(":ui"))
+    implementation(files("libs/authenticatorbridge-1.0.0-release.aar"))

    implementation(libs.androidx.activity.compose)
    implementation(libs.androidx.appcompat)
@@ -235,17 +222,16 @@ dependencies {
    implementation(libs.androidx.browser)
    implementation(libs.androidx.biometrics)
    implementation(libs.androidx.camera.camera2)
+    implementation(libs.androidx.camera.lifecycle)
+    implementation(libs.androidx.camera.view)
    implementation(platform(libs.androidx.compose.bom))
    implementation(libs.androidx.compose.animation)
    implementation(libs.androidx.compose.material3)
-    implementation(libs.androidx.compose.material3.adaptive)
    implementation(libs.androidx.compose.runtime)
    implementation(libs.androidx.compose.ui)
    implementation(libs.androidx.compose.ui.graphics)
    implementation(libs.androidx.compose.ui.tooling.preview)
    implementation(libs.androidx.core.ktx)
-    implementation(libs.androidx.credentials)
-    implementation(libs.androidx.credentials.providerevents)
    implementation(libs.androidx.hilt.navigation.compose)
    implementation(libs.androidx.lifecycle.process)
    implementation(libs.androidx.lifecycle.runtime.compose)
@@ -259,16 +245,20 @@ dependencies {
    implementation(libs.androidx.work.runtime.ktx)
    implementation(libs.bitwarden.sdk)
    implementation(libs.bumptech.glide)
+    implementation(libs.androidx.credentials)
    implementation(libs.google.hilt.android)
    ksp(libs.google.hilt.compiler)
    implementation(libs.kotlinx.collections.immutable)
    implementation(libs.kotlinx.coroutines.android)
    implementation(libs.kotlinx.serialization)
-    implementation(platform(libs.square.okhttp.bom))
+    implementation(libs.nulab.zxcvbn4j)
    implementation(libs.square.okhttp)
+    implementation(libs.square.okhttp.logging)
    implementation(platform(libs.square.retrofit.bom))
    implementation(libs.square.retrofit)
+    implementation(libs.square.retrofit.kotlinx.serialization)
    implementation(libs.timber)
+    implementation(libs.zxing.zxing.core)

    // For now we are restricted to running Compose tests for debug builds only
    debugImplementation(libs.androidx.compose.ui.test.manifest)
@@ -280,29 +270,105 @@ dependencies {
    standardImplementation(libs.google.firebase.crashlytics)
    standardImplementation(libs.google.play.review)

-    // Pull in test fixtures from other modules
-    testImplementation(testFixtures(project(":data")))
-    testImplementation(testFixtures(project(":network")))
-    testImplementation(testFixtures(project(":ui")))
-
    testImplementation(libs.androidx.compose.ui.test)
    testImplementation(libs.google.hilt.android.testing)
-    testImplementation(platform(libs.junit.bom))
-    testRuntimeOnly(libs.junit.platform.launcher)
-    testImplementation(libs.junit.jupiter)
+    testImplementation(libs.junit.junit5)
    testImplementation(libs.junit.vintage)
    testImplementation(libs.kotlinx.coroutines.test)
    testImplementation(libs.mockk.mockk)
    testImplementation(libs.robolectric.robolectric)
+    testImplementation(libs.square.okhttp.mockwebserver)
    testImplementation(libs.square.turbine)
+
+    detektPlugins(libs.detekt.detekt.formatting)
+    detektPlugins(libs.detekt.detekt.rules)
+}
+
+detekt {
+    autoCorrect = true
+    config.from(files("$rootDir/detekt-config.yml"))
+}
+
+kover {
+    currentProject {
+        sources {
+            excludeJava = true
+        }
+    }
+    reports {
+        filters {
+            excludes {
+                androidGeneratedClasses()
+                annotatedBy(
+                    // Compose previews
+                    "androidx.compose.ui.tooling.preview.Preview",
+                    "androidx.compose.ui.tooling.preview.PreviewScreenSizes",
+                    // Manually excluded classes/files/etc.
+                    "com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage",
+                )
+                classes(
+                    // Navigation helpers
+                    "*.*NavigationKt*",
+                    // Composable singletons
+                    "*.*ComposableSingletons*",
+                    // Generated classes related to interfaces with default values
+                    "*.*DefaultImpls*",
+                    // Databases
+                    "*.database.*Database*",
+                    "*.dao.*Dao*",
+                    // Dagger Hilt
+                    "dagger.hilt.*",
+                    "hilt_aggregated_deps.*",
+                    "*_Factory",
+                    "*_Factory\$*",
+                    "*_*Factory",
+                    "*_*Factory\$*",
+                    "*.Hilt_*",
+                    "*_HiltModules",
+                    "*_HiltModules*",
+                    "*_HiltModules\$*",
+                    "*_Impl",
+                    "*_Impl\$*",
+                    "*_MembersInjector",
+                )
+                packages(
+                    // Dependency injection
+                    "*.di",
+                    // Models
+                    "*.model",
+                    // Custom UI components
+                    "com.x8bit.bitwarden.ui.platform.components",
+                    // Theme-related code
+                    "com.x8bit.bitwarden.ui.platform.theme",
+                )
+            }
+        }
+    }
 }

 tasks {
+    getByName("check") {
+        // Add detekt with type resolution to check
+        dependsOn("detekt")
+    }
+
+    getByName("sonar") {
+        dependsOn("check")
+    }
+
+    withType<io.gitlab.arturbosch.detekt.Detekt>().configureEach {
+        jvmTarget = libs.versions.jvmTarget.get()
+    }
+    withType<io.gitlab.arturbosch.detekt.DetektCreateBaselineTask>().configureEach {
+        jvmTarget = libs.versions.jvmTarget.get()
+    }
+
    withType<Test> {
        useJUnitPlatform()
        maxHeapSize = "2g"
        maxParallelForks = Runtime.getRuntime().availableProcessors()
-        jvmArgs = jvmArgs.orEmpty() + "-XX:+UseParallelGC" + "-Duser.country=US"
+        jvmArgs = jvmArgs.orEmpty() + "-XX:+UseParallelGC"
+        android.sourceSets["main"].res.srcDirs("src/test/res")
    }
 }

@@ -316,6 +382,18 @@ afterEvaluate {
        .forEach { it.enabled = false }
 }

+sonar {
+    properties {
+        property("sonar.projectKey", "bitwarden_android")
+        property("sonar.organization", "bitwarden")
+        property("sonar.host.url", "https://sonarcloud.io")
+        property("sonar.sources", "app/src/")
+        property("sonar.tests", "app/src/")
+        property("sonar.test.inclusions", "app/src/test/")
+        property("sonar.exclusions", "app/src/test/")
+    }
+}
+
 private fun renameFile(path: String, newName: String) {
    val originalFile = File(path)
    if (!originalFile.exists()) {
@@ -327,7 +405,6 @@ private fun renameFile(path: String, newName: String) {
    if (originalFile.renameTo(newFile)) {
        println("Renamed $originalFile to $newFile")
    } else {
-        @Suppress("TooGenericExceptionThrown")
        throw RuntimeException("Failed to rename $originalFile to $newFile")
    }
 }
--- a/app/libs/authenticatorbridge-1.0.0-release.aar
+++ b/app/libs/authenticatorbridge-1.0.0-release.aar
--- a/app/libs/authenticatorbridge-1.0.1-release.aar
+++ b/app/libs/authenticatorbridge-1.0.1-release.aar
--- a/app/schemas/com.x8bit.bitwarden.data.credentials.datasource.disk.database.PrivilegedAppDatabase/1.json
+++ b/app/schemas/com.x8bit.bitwarden.data.credentials.datasource.disk.database.PrivilegedAppDatabase/1.json
@@ -1,38 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 1,
-    "identityHash": "ce40856ec88770d11b7afb587c7deabc",
-    "entities": [
-      {
-        "tableName": "privileged_apps",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`package_name` TEXT NOT NULL, `signature` TEXT NOT NULL, PRIMARY KEY(`package_name`, `signature`))",
-        "fields": [
-          {
-            "fieldPath": "packageName",
-            "columnName": "package_name",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "signature",
-            "columnName": "signature",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "package_name",
-            "signature"
-          ]
-        }
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'ce40856ec88770d11b7afb587c7deabc')"
-    ]
-  }
-}
--- a/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/7.json
+++ b/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/7.json
@@ -1,252 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 7,
-    "identityHash": "4c6ad1f5268d7e8add7407201788aa2e",
-    "entities": [
-      {
-        "tableName": "ciphers",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `has_totp` INTEGER NOT NULL DEFAULT 1, `cipher_type` TEXT NOT NULL, `cipher_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "hasTotp",
-            "columnName": "has_totp",
-            "affinity": "INTEGER",
-            "notNull": true,
-            "defaultValue": "1"
-          },
-          {
-            "fieldPath": "cipherType",
-            "columnName": "cipher_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "cipherJson",
-            "columnName": "cipher_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_ciphers_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_ciphers_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "collections",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `organization_id` TEXT NOT NULL, `should_hide_passwords` INTEGER NOT NULL, `name` TEXT NOT NULL, `external_id` TEXT, `read_only` INTEGER NOT NULL, `manage` INTEGER, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "organizationId",
-            "columnName": "organization_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "shouldHidePasswords",
-            "columnName": "should_hide_passwords",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "externalId",
-            "columnName": "external_id",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "isReadOnly",
-            "columnName": "read_only",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "canManage",
-            "columnName": "manage",
-            "affinity": "INTEGER"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_collections_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_collections_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "domains",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`user_id` TEXT NOT NULL, `domains_json` TEXT, PRIMARY KEY(`user_id`))",
-        "fields": [
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "domainsJson",
-            "columnName": "domains_json",
-            "affinity": "TEXT"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "user_id"
-          ]
-        }
-      },
-      {
-        "tableName": "folders",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `name` TEXT, `revision_date` INTEGER NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "revisionDate",
-            "columnName": "revision_date",
-            "affinity": "INTEGER",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_folders_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_folders_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "sends",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `send_type` TEXT NOT NULL, `send_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendType",
-            "columnName": "send_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendJson",
-            "columnName": "send_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_sends_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_sends_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '4c6ad1f5268d7e8add7407201788aa2e')"
-    ]
-  }
-}
--- a/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/8.json
+++ b/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/8.json
@@ -1,264 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 8,
-    "identityHash": "11387825dab701f9d2dd2e940ffbd794",
-    "entities": [
-      {
-        "tableName": "ciphers",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `has_totp` INTEGER NOT NULL DEFAULT 1, `cipher_type` TEXT NOT NULL, `cipher_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "hasTotp",
-            "columnName": "has_totp",
-            "affinity": "INTEGER",
-            "notNull": true,
-            "defaultValue": "1"
-          },
-          {
-            "fieldPath": "cipherType",
-            "columnName": "cipher_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "cipherJson",
-            "columnName": "cipher_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_ciphers_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_ciphers_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "collections",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `organization_id` TEXT NOT NULL, `should_hide_passwords` INTEGER NOT NULL, `name` TEXT NOT NULL, `external_id` TEXT, `read_only` INTEGER NOT NULL, `manage` INTEGER, `default_user_collection_email` TEXT, `type` TEXT NOT NULL DEFAULT '0', PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "organizationId",
-            "columnName": "organization_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "shouldHidePasswords",
-            "columnName": "should_hide_passwords",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "externalId",
-            "columnName": "external_id",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "isReadOnly",
-            "columnName": "read_only",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "canManage",
-            "columnName": "manage",
-            "affinity": "INTEGER"
-          },
-          {
-            "fieldPath": "defaultUserCollectionEmail",
-            "columnName": "default_user_collection_email",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "type",
-            "columnName": "type",
-            "affinity": "TEXT",
-            "notNull": true,
-            "defaultValue": "'0'"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_collections_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_collections_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "domains",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`user_id` TEXT NOT NULL, `domains_json` TEXT, PRIMARY KEY(`user_id`))",
-        "fields": [
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "domainsJson",
-            "columnName": "domains_json",
-            "affinity": "TEXT"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "user_id"
-          ]
-        }
-      },
-      {
-        "tableName": "folders",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `name` TEXT, `revision_date` INTEGER NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "revisionDate",
-            "columnName": "revision_date",
-            "affinity": "INTEGER",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_folders_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_folders_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "sends",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `send_type` TEXT NOT NULL, `send_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendType",
-            "columnName": "send_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendJson",
-            "columnName": "send_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_sends_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_sends_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '11387825dab701f9d2dd2e940ffbd794')"
-    ]
-  }
-}
--- a/app/src/beta/AndroidManifest.xml
+++ b/app/src/beta/AndroidManifest.xml
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application tools:ignore="MissingApplicationIcon">
-        <activity
-            android:name=".MainActivity">
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-
-                <data android:scheme="https" />
-                <data android:host="*.bitwarden.pw" />
-                <data android:pathPattern="/redirect-connector.*" />
-            </intent-filter>
-        </activity>
-    </application>
-
-</manifest>
--- a/app/src/debug/AndroidManifest.xml
+++ b/app/src/debug/AndroidManifest.xml
@@ -7,20 +7,6 @@
        <meta-data
            android:name="firebase_crashlytics_collection_enabled"
            android:value="false" />
-        <activity
-            android:name=".MainActivity"
-            tools:ignore="IntentFilterExportedReceiver">
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-
-                <data android:scheme="https" />
-                <data android:host="*.bitwarden.pw" />
-                <data android:pathPattern="/redirect-connector.*" />
-            </intent-filter>
-        </activity>
    </application>

 </manifest>
--- a/app/src/debug/res/xml/network_security_config.xml
+++ b/app/src/debug/res/xml/network_security_config.xml
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<network-security-config xmlns:tools="http://schemas.android.com/tools">
-
-    <base-config
-        cleartextTrafficPermitted="true"
-        tools:ignore="InsecureBaseConfiguration">
-        <trust-anchors>
-            <!-- Trust pre-installed CAs -->
-            <certificates src="system" />
-            <!-- Additionally trust user added CAs -->
-            <certificates
-                src="user"
-                tools:ignore="AcceptsUserCertificates" />
-        </trust-anchors>
-    </base-config>
-
-    <domain-config cleartextTrafficPermitted="false">
-        <domain includeSubdomains="true">bitwarden.com</domain>
-        <domain includeSubdomains="true">bitwarden.eu</domain>
-        <domain includeSubdomains="true">bitwarden.pw</domain>
-        <trust-anchors>
-            <!-- Only trust pre-installed CAs for Bitwarden domains and all subdomains -->
-            <certificates src="system" />
-        </trust-anchors>
-    </domain-config>
-
-</network-security-config>
--- a/app/src/debug/res/xml/provider.xml
+++ b/app/src/debug/res/xml/provider.xml
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<credential-provider>
-    <capabilities>
-        <capability name="android.credentials.TYPE_PASSWORD_CREDENTIAL" />
-        <capability name="androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" />
-    </capabilities>
-</credential-provider>
--- a/app/src/fdroid/java/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
+++ b/app/src/fdroid/java/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
@@ -0,0 +1,27 @@
+package com.x8bit.bitwarden.data.platform.manager
+
+import com.x8bit.bitwarden.BuildConfig
+import com.x8bit.bitwarden.data.platform.datasource.disk.legacy.LegacyAppCenterMigrator
+import com.x8bit.bitwarden.data.platform.repository.SettingsRepository
+import com.x8bit.bitwarden.data.platform.repository.model.Environment
+import timber.log.Timber
+
+/**
+ * [LogsManager] implementation for F-droid flavor builds.
+ */
+class LogsManagerImpl(
+    settingsRepository: SettingsRepository,
+    legacyAppCenterMigrator: LegacyAppCenterMigrator,
+) : LogsManager {
+    init {
+        if (BuildConfig.HAS_LOGS_ENABLED) {
+            Timber.plant(Timber.DebugTree())
+        }
+    }
+
+    override var isEnabled: Boolean = false
+
+    override fun setUserData(userId: String?, environmentType: Environment.Type) = Unit
+
+    override fun trackNonFatalException(throwable: Throwable) = Unit
+}
--- a/app/src/fdroid/kotlin/com/x8bit/bitwarden/ui/platform/manager/review/AppReviewManagerImpl.kt
+++ b/app/src/fdroid/kotlin/com/x8bit/bitwarden/ui/platform/manager/review/AppReviewManagerImpl.kt
--- a/app/src/fdroid/kotlin/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
+++ b/app/src/fdroid/kotlin/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
@@ -1,27 +0,0 @@
-package com.x8bit.bitwarden.data.platform.manager
-
-import com.bitwarden.data.repository.model.Environment
-import com.x8bit.bitwarden.BuildConfig
-import com.x8bit.bitwarden.data.platform.datasource.disk.legacy.LegacyAppCenterMigrator
-import com.x8bit.bitwarden.data.platform.repository.SettingsRepository
-import timber.log.Timber
-
-/**
- * [LogsManager] implementation for F-droid flavor builds.
- */
-class LogsManagerImpl(
-    settingsRepository: SettingsRepository,
-    legacyAppCenterMigrator: LegacyAppCenterMigrator,
-) : LogsManager {
-    init {
-        if (BuildConfig.HAS_LOGS_ENABLED) {
-            Timber.plant(Timber.DebugTree())
-        }
-    }
-
-    override var isEnabled: Boolean = false
-
-    override fun setUserData(userId: String?, environmentType: Environment.Type) = Unit
-
-    override fun trackNonFatalException(throwable: Throwable) = Unit
-}
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -15,7 +15,7 @@
    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.READ_USER_DICTIONARY" />
+    <uses-permission android:name="android.permission.READ_USER_DICTIONARY"/>
    <!-- Protect access to AuthenticatorBridgeService using this custom permission.

    Note that each build type uses a different value for knownCerts.
@@ -37,18 +37,15 @@
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
-        android:intentMatchingFlags="enforceIntentFilter"
        android:label="@string/app_name"
        android:networkSecurityConfig="@xml/network_security_config"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/LaunchTheme"
-        tools:ignore="CredentialDependency"
        tools:replace="appComponentFactory"
-        tools:targetApi="36">
+        tools:targetApi="33">
        <activity
            android:name=".MainActivity"
-            android:configChanges="uiMode"
            android:exported="true"
            android:launchMode="@integer/launchModeAPIlevel"
            android:theme="@style/LaunchTheme"
@@ -79,15 +76,16 @@
                <category android:name="android.intent.category.BROWSABLE" />

                <data android:scheme="https" />
-                <data android:host="*.bitwarden.com" />
-                <data android:host="*.bitwarden.eu" />
+
+                <data android:host="vault.bitwarden.com" />
+                <data android:host="vault.bitwarden.eu" />
+                <data android:host="*.bitwarden.pw" />
                <data android:pathPattern="/redirect-connector.*" />
            </intent-filter>
            <intent-filter>
-                <action android:name="com.x8bit.bitwarden.credentials.ACTION_CREATE_PASSKEY" />
-                <action android:name="com.x8bit.bitwarden.credentials.ACTION_GET_PASSKEY" />
-                <action android:name="com.x8bit.bitwarden.credentials.ACTION_GET_PASSWORD" />
-                <action android:name="com.x8bit.bitwarden.credentials.ACTION_UNLOCK_ACCOUNT" />
+                <action android:name="com.x8bit.bitwarden.fido2.ACTION_CREATE_PASSKEY" />
+                <action android:name="com.x8bit.bitwarden.fido2.ACTION_GET_PASSKEY" />
+                <action android:name="com.x8bit.bitwarden.fido2.ACTION_UNLOCK_ACCOUNT" />

                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
@@ -105,17 +103,6 @@
                <category android:name="android.intent.category.DEFAULT" />
                <data android:scheme="bitwarden" />
            </intent-filter>
-            <!-- Handle Credential Exchange transfer requests -->
-            <intent-filter
-                android:autoVerify="true"
-                tools:ignore="AppLinkUrlError">
-                <action android:name="androidx.identitycredentials.action.IMPORT_CREDENTIALS" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <data
-                    android:mimeType="application/octet-stream"
-                    android:scheme="content"
-                    tools:ignore="AppLinkUriRelativeFilterGroupError" />
-            </intent-filter>
        </activity>

        <activity
@@ -126,11 +113,11 @@
            android:theme="@android:style/Theme.NoDisplay" />

        <activity
-            android:name=".AutofillCallbackActivity"
+            android:name=".AutofillTotpCopyActivity"
            android:exported="true"
            android:launchMode="singleTop"
            android:noHistory="true"
-            android:theme="@style/AutofillCallbackTheme" />
+            android:theme="@style/AutofillTotpCopyTheme" />

        <activity
            android:name=".AuthCallbackActivity"
@@ -144,6 +131,16 @@
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />

+                <data
+                    android:host="captcha-callback"
+                    android:scheme="bitwarden" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+
                <data
                    android:host="duo-callback"
                    android:scheme="bitwarden" />
@@ -260,7 +257,7 @@
            android:name="com.x8bit.bitwarden.AutofillTileService"
            android:exported="true"
            android:icon="@drawable/ic_notification"
-            android:label="@string/autofill_title"
+            android:label="@string/autofill"
            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
            tools:ignore="MissingClass">
            <intent-filter>
@@ -313,14 +310,6 @@
            android:exported="true"
            android:permission="${applicationId}.permission.AUTHENTICATOR_BRIDGE_SERVICE" />

-        <!-- Firebase SDK initOrder is 100. We use a higher order to initialize first -->
-        <provider
-            android:name=".data.platform.contentprovider.UncaughtErrorLoggingContentProvider"
-            android:authorities="${applicationId}"
-            android:exported="false"
-            android:grantUriPermissions="false"
-            android:initOrder="101" />
-
    </application>

    <queries>
@@ -331,19 +320,11 @@
            <action android:name="android.intent.action.MAIN" />
            <category android:name="android.intent.category.HOME" />
        </intent>
-        <!-- To Query Privileged Apps -->
-        <intent>
-            <action android:name="android.intent.action.VIEW" />
-            <data android:scheme="http" />
-        </intent>
        <!-- To Query Chrome Beta: -->
        <package android:name="com.chrome.beta" />

        <!-- To Query Chrome Stable: -->
        <package android:name="com.android.chrome" />
-
-        <!-- To Query Brave Stable: -->
-        <package android:name="com.brave.browser" />
    </queries>

 </manifest>
--- a/app/src/main/assets/fido2_privileged_community.json
+++ b/app/src/main/assets/fido2_privileged_community.json
@@ -12,6 +12,20 @@
        ]
      }
    },
+
+    {
+      "type": "android",
+      "info": {
+        "package_name": "net.quetta.browser",
+        "signatures": [
+          {
+            "build": "release",
+            "cert_fingerprint_sha256": "BE:FE:E7:31:12:6A:A5:6E:7E:FD:AE:AF:5E:F3:FA:EA:44:1C:19:CC:E0:CA:EC:42:6B:65:BB:F8:2C:59:46:80"
+          }
+        ]
+      }
+    },
+
    {
      "type": "android",
      "info": {
@@ -51,11 +65,11 @@
    {
      "type": "android",
      "info": {
-        "package_name": "org.ironfoxoss.ironfox.nightly",
+        "package_name": "org.mozilla.fenix",
        "signatures": [
          {
            "build": "release",
-            "cert_fingerprint_sha256": "C5:E2:91:B5:A5:71:F9:C8:CD:9A:97:99:C2:C9:4E:02:EC:97:03:94:88:93:F2:CA:75:6D:67:B9:42:04:F9:04"
+            "cert_fingerprint_sha256": "50:04:77:90:88:E7:F9:88:D5:BC:5C:C5:F8:79:8F:EB:F4:F8:CD:08:4A:1B:2A:46:EF:D4:C8:EE:4A:EA:F2:11"
          }
        ]
      }
--- a/app/src/main/assets/fido2_privileged_google.json
+++ b/app/src/main/assets/fido2_privileged_google.json
@@ -160,78 +160,6 @@
        ]
      }
    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.fenix",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "50:04:77:90:88:E7:F9:88:D5:BC:5C:C5:F8:79:8F:EB:F4:F8:CD:08:4A:1B:2A:46:EF:D4:C8:EE:4A:EA:F2:11"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.fenix.debug",
-        "signatures": [
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "BD:AE:82:02:80:D2:AF:B7:74:94:EF:22:58:AA:78:A9:AE:A1:36:41:7E:8B:C2:3D:C9:87:75:2E:6F:48:E8:48"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.focus.beta",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "62:03:A4:73:BE:36:D6:4E:E3:7F:87:FA:50:0E:DB:C7:9E:AB:93:06:10:AB:9B:9F:A4:CA:7D:5C:1F:1B:4F:FC"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.focus.nightly",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "62:03:A4:73:BE:36:D6:4E:E3:7F:87:FA:50:0E:DB:C7:9E:AB:93:06:10:AB:9B:9F:A4:CA:7D:5C:1F:1B:4F:FC"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.klar",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "62:03:A4:73:BE:36:D6:4E:E3:7F:87:FA:50:0E:DB:C7:9E:AB:93:06:10:AB:9B:9F:A4:CA:7D:5C:1F:1B:4F:FC"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "org.mozilla.reference.browser",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "B0:09:90:E3:0F:9D:81:5D:2E:BC:7B:9B:B2:21:CE:47:E5:C9:D5:17:AA:C7:0E:7F:D5:95:B1:E5:3E:9A:4B:14"
-          }
-        ]
-      }
-    },
    {
      "type": "android",
      "info": {
@@ -643,178 +571,6 @@
          }
        ]
      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.Island",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "D9:C3:39:AC:9C:3A:EE:E1:75:1D:85:8C:35:D9:BA:C5:CC:87:B3:CE:76:30:93:F0:F5:10:64:F5:A2:F6:9B:04"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.IslandCanary",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "90:17:13:23:45:6E:6F:39:CB:FD:CF:B2:56:BE:1D:CF:F3:BC:1C:59:8A:15:93:30:E4:97:73:D0:4C:B9:C9:05"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.IslandBeta",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "35:31:83:1A:9E:2B:21:1D:E6:AA:C3:69:4B:45:83:6E:56:09:B9:D7:D0:04:C3:1B:21:87:40:FB:77:17:38:D1"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.IslandDev",
-        "signatures": [
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.island.intune",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "C2:38:24:15:41:20:A0:8F:C3:95:42:AC:D8:2A:E9:24:94:78:80:1E:47:FD:6C:66:2B:18:1C:28:CA:7E:59:4E"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.island.canary.intune",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "1E:16:74:BB:79:EA:09:FB:37:CF:9F:1B:07:1B:1D:51:8D:46:03:0E:D3:EE:F2:C1:4E:AD:93:9E:C6:EE:3A:4C"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.island.beta.intune",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "D2:5E:AD:F6:1C:E6:36:6C:A4:23:A4:7F:C4:DB:9B:8C:9C:8A:35:B4:B0:19:E8:D9:82:FB:D0:8A:D9:DB:49:5A"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "io.island.island.dev.intune",
-        "signatures": [
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "6C:65:BD:B0:33:F5:CE:B1:74:09:EF:F9:99:48:D5:58:9F:55:63:9A:63:78:D5:A5:00:EB:95:FC:01:BC:6D:44"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "net.quetta.browser",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "BE:FE:E7:31:12:6A:A5:6E:7E:FD:AE:AF:5E:F3:FA:EA:44:1C:19:CC:E0:CA:EC:42:6B:65:BB:F8:2C:59:46:80"
-          },
-          {
-            "build": "userdebug",
-            "cert_fingerprint_sha256": "F1:38:00:4F:38:04:51:D4:8A:05:2B:B3:A3:EF:17:24:23:D4:B0:D0:C8:A3:AA:DD:FB:DB:66:30:31:48:EC:A4"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "cz.seznam.sbrowser",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "DB:95:40:66:10:78:83:6E:4E:B1:66:F6:9E:F4:07:30:9E:8D:AE:33:34:68:5E:C8:F6:FA:2F:13:81:B9:AC:F6"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.opera.mini.native",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "57:AC:BC:52:5F:1B:2E:BD:19:19:6C:D6:F0:14:39:7C:C9:10:FD:18:84:1E:0A:E8:50:FE:BC:3E:1E:59:3F:F2"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.opera.mini.native.beta",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "57:AC:BC:52:5F:1B:2E:BD:19:19:6C:D6:F0:14:39:7C:C9:10:FD:18:84:1E:0A:E8:50:FE:BC:3E:1E:59:3F:F2"
-          }
-        ]
-      }
    }
  ]
-}
+}
--- a/app/src/main/java/com/x8bit/bitwarden/AccessibilityActivity.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/AccessibilityActivity.kt
@@ -0,0 +1,17 @@
+package com.x8bit.bitwarden
+
+import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
+
+/**
+ * An activity to be launched and then immediately closed so that the OS Shade can be collapsed
+ * after the user clicks on the Autofill Quick Tile.
+ */
+@OmitFromCoverage
+class AccessibilityActivity : AppCompatActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        finish()
+    }
+}
--- a/app/src/main/java/com/x8bit/bitwarden/AuthCallbackActivity.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/AuthCallbackActivity.kt
@@ -0,0 +1,38 @@
+package com.x8bit.bitwarden
+
+import android.content.Intent
+import android.os.Bundle
+import androidx.activity.viewModels
+import androidx.appcompat.app.AppCompatActivity
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
+import dagger.hilt.android.AndroidEntryPoint
+
+/**
+ * An activity to receive external authentication-related callbacks so the current state of the
+ * task holding the [MainActivity] can remain undisturbed.
+ *
+ * These callbacks can be from Custom Chrome tabs or other auth related flows, including NFC
+ * related transmissions.
+ */
+@OmitFromCoverage
+@AndroidEntryPoint
+class AuthCallbackActivity : AppCompatActivity() {
+
+    private val viewModel: AuthCallbackViewModel by viewModels()
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        viewModel.trySendAction(AuthCallbackAction.IntentReceive(intent = intent))
+
+        val intent = Intent(this, MainActivity::class.java)
+            .apply {
+                addFlags(
+                    Intent.FLAG_ACTIVITY_CLEAR_TOP or
+                        Intent.FLAG_ACTIVITY_SINGLE_TOP,
+                )
+            }
+        startActivity(intent)
+        finish()
+    }
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackViewModel.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackViewModel.kt
@@ -1,12 +1,13 @@
 package com.x8bit.bitwarden

 import android.content.Intent
-import com.bitwarden.ui.platform.base.BaseViewModel
 import com.x8bit.bitwarden.data.auth.repository.AuthRepository
+import com.x8bit.bitwarden.data.auth.repository.util.getCaptchaCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.getDuoCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.getSsoCallbackResult
 import com.x8bit.bitwarden.data.auth.repository.util.getWebAuthResultOrNull
 import com.x8bit.bitwarden.data.auth.util.getYubiKeyResultOrNull
+import com.x8bit.bitwarden.ui.platform.base.BaseViewModel
 import dagger.hilt.android.lifecycle.HiltViewModel
 import javax.inject.Inject

@@ -26,6 +27,7 @@ class AuthCallbackViewModel @Inject constructor(
    private fun handleIntentReceived(action: AuthCallbackAction.IntentReceive) {
        val yubiKeyResult = action.intent.getYubiKeyResultOrNull()
        val webAuthResult = action.intent.getWebAuthResultOrNull()
+        val captchaCallbackTokenResult = action.intent.getCaptchaCallbackTokenResult()
        val duoCallbackTokenResult = action.intent.getDuoCallbackTokenResult()
        val ssoCallbackResult = action.intent.getSsoCallbackResult()
        when {
@@ -33,6 +35,12 @@ class AuthCallbackViewModel @Inject constructor(
                authRepository.setYubiKeyResult(yubiKeyResult = yubiKeyResult)
            }

+            captchaCallbackTokenResult != null -> {
+                authRepository.setCaptchaCallbackTokenResult(
+                    tokenResult = captchaCallbackTokenResult,
+                )
+            }
+
            duoCallbackTokenResult != null -> {
                authRepository.setDuoCallbackTokenResult(
                    tokenResult = duoCallbackTokenResult,
--- a/app/src/main/java/com/x8bit/bitwarden/AutofillTotpCopyActivity.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/AutofillTotpCopyActivity.kt
@@ -0,0 +1,74 @@
+package com.x8bit.bitwarden
+
+import android.os.Bundle
+import androidx.activity.viewModels
+import androidx.appcompat.app.AppCompatActivity
+import androidx.lifecycle.lifecycleScope
+import com.x8bit.bitwarden.data.autofill.manager.AutofillCompletionManager
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
+import dagger.hilt.android.AndroidEntryPoint
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.onEach
+import javax.inject.Inject
+
+/**
+ * An activity for copying a TOTP code to the clipboard. This is done when an autofill item is
+ * selected and it requires TOTP authentication. Due to the constraints of the autofill framework,
+ * we also have to re-fulfill the autofill for the views that are being filled.
+ */
+@OmitFromCoverage
+@AndroidEntryPoint
+class AutofillTotpCopyActivity : AppCompatActivity() {
+
+    @Inject
+    lateinit var autofillCompletionManager: AutofillCompletionManager
+
+    private val autofillTotpCopyViewModel: AutofillTotpCopyViewModel by viewModels()
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        observeViewModelEvents()
+
+        autofillTotpCopyViewModel.trySendAction(
+            AutofillTotpCopyAction.IntentReceived(
+                intent = intent,
+            ),
+        )
+    }
+
+    private fun observeViewModelEvents() {
+        autofillTotpCopyViewModel
+            .eventFlow
+            .onEach { event ->
+                when (event) {
+                    is AutofillTotpCopyEvent.CompleteAutofill -> {
+                        handleCompleteAutofill(event)
+                    }
+
+                    is AutofillTotpCopyEvent.FinishActivity -> {
+                        finishActivity()
+                    }
+                }
+            }
+            .launchIn(lifecycleScope)
+    }
+
+    /**
+     * Complete autofill with the provided data.
+     */
+    private fun handleCompleteAutofill(event: AutofillTotpCopyEvent.CompleteAutofill) {
+        autofillCompletionManager.completeAutofill(
+            activity = this,
+            cipherView = event.cipherView,
+        )
+    }
+
+    /**
+     * Finish the activity.
+     */
+    private fun finishActivity() {
+        setResult(RESULT_CANCELED)
+        finish()
+    }
+}
--- a/app/src/main/java/com/x8bit/bitwarden/AutofillTotpCopyViewModel.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/AutofillTotpCopyViewModel.kt
@@ -0,0 +1,121 @@
+package com.x8bit.bitwarden
+
+import android.content.Intent
+import androidx.lifecycle.viewModelScope
+import com.bitwarden.vault.CipherView
+import com.x8bit.bitwarden.data.auth.repository.AuthRepository
+import com.x8bit.bitwarden.data.autofill.util.getTotpCopyIntentOrNull
+import com.x8bit.bitwarden.data.platform.util.launchWithTimeout
+import com.x8bit.bitwarden.data.vault.repository.VaultRepository
+import com.x8bit.bitwarden.data.vault.repository.model.VaultUnlockData
+import com.x8bit.bitwarden.data.vault.repository.util.statusFor
+import com.x8bit.bitwarden.ui.platform.base.BaseViewModel
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.mapNotNull
+import javax.inject.Inject
+
+/**
+ * The amount of time we should wait for ciphers to be loaded before timing out.
+ */
+private const val CIPHER_WAIT_TIMEOUT_MILLIS: Long = 500
+
+/**
+ * A view model that handles logic for the [AutofillTotpCopyActivity].
+ */
+@HiltViewModel
+class AutofillTotpCopyViewModel @Inject constructor(
+    private val authRepository: AuthRepository,
+    private val vaultRepository: VaultRepository,
+) : BaseViewModel<Unit, AutofillTotpCopyEvent, AutofillTotpCopyAction>(Unit) {
+    private val activeUserId: String? get() = authRepository.activeUserId
+
+    override fun handleAction(action: AutofillTotpCopyAction): Unit = when (action) {
+        is AutofillTotpCopyAction.IntentReceived -> handleIntentReceived(action)
+    }
+
+    /**
+     * Process the received intent and alert the activity of what to do next.
+     */
+    private fun handleIntentReceived(action: AutofillTotpCopyAction.IntentReceived) {
+        viewModelScope
+            .launchWithTimeout(
+                timeoutBlock = { finishActivity() },
+                timeoutDuration = CIPHER_WAIT_TIMEOUT_MILLIS,
+            ) {
+                // Extract TOTP copy data from the intent.
+                val cipherId = action
+                    .intent
+                    .getTotpCopyIntentOrNull()
+                    ?.cipherId
+
+                if (cipherId == null || isVaultLocked()) {
+                    finishActivity()
+                    return@launchWithTimeout
+                }
+
+                // Try and find the matching cipher.
+                vaultRepository
+                    .ciphersStateFlow
+                    .mapNotNull { it.data }
+                    .first()
+                    .find { it.id == cipherId }
+                    ?.let { cipherView ->
+                        sendEvent(
+                            AutofillTotpCopyEvent.CompleteAutofill(
+                                cipherView = cipherView,
+                            ),
+                        )
+                    }
+                    ?: finishActivity()
+            }
+    }
+
+    /**
+     * Send an event to the activity that signals it to finish.
+     */
+    private fun finishActivity() {
+        sendEvent(AutofillTotpCopyEvent.FinishActivity)
+    }
+
+    private suspend fun isVaultLocked(): Boolean {
+        val userId = activeUserId ?: return true
+
+        // Wait for any unlocking actions to finish. This can be relevant on startup for Never lock
+        // accounts.
+        vaultRepository.vaultUnlockDataStateFlow.first {
+            it.statusFor(userId) != VaultUnlockData.Status.UNLOCKING
+        }
+
+        return !vaultRepository.isVaultUnlocked(userId = userId)
+    }
+}
+
+/**
+ * Represents actions that can be sent to the [AutofillTotpCopyViewModel].
+ */
+sealed class AutofillTotpCopyAction {
+    /**
+     * An [intent] has been received and is ready to be processed.
+     */
+    data class IntentReceived(
+        val intent: Intent,
+    ) : AutofillTotpCopyAction()
+}
+
+/**
+ * Represents events emitted by the [AutofillTotpCopyViewModel].
+ */
+sealed class AutofillTotpCopyEvent {
+    /**
+     * Complete autofill with the provided [cipherView].
+     */
+    data class CompleteAutofill(
+        val cipherView: CipherView,
+    ) : AutofillTotpCopyEvent()
+
+    /**
+     * Finish the activity.
+     */
+    data object FinishActivity : AutofillTotpCopyEvent()
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenAppComponentFactory.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenAppComponentFactory.kt
@@ -5,10 +5,10 @@ import android.content.Intent
 import android.os.Build
 import androidx.annotation.Keep
 import androidx.core.app.AppComponentFactory
-import com.bitwarden.annotation.OmitFromCoverage
 import com.x8bit.bitwarden.data.autofill.BitwardenAutofillService
 import com.x8bit.bitwarden.data.autofill.accessibility.BitwardenAccessibilityService
-import com.x8bit.bitwarden.data.credentials.BitwardenCredentialProviderService
+import com.x8bit.bitwarden.data.autofill.fido2.BitwardenFido2ProviderService
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
 import com.x8bit.bitwarden.data.tiles.BitwardenAutofillTileService
 import com.x8bit.bitwarden.data.tiles.BitwardenGeneratorTileService
 import com.x8bit.bitwarden.data.tiles.BitwardenVaultTileService
@@ -30,7 +30,7 @@ class BitwardenAppComponentFactory : AppComponentFactory() {
     * * [BitwardenAccessibilityService]
     * * [BitwardenAutofillService]
     * * [BitwardenAutofillTileService]
-     * * [BitwardenCredentialProviderService]
+     * * [BitwardenFido2ProviderService]
     * * [BitwardenVaultTileService]
     * * [BitwardenGeneratorTileService]
     */
@@ -63,7 +63,7 @@ class BitwardenAppComponentFactory : AppComponentFactory() {
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
                super.instantiateServiceCompat(
                    cl,
-                    BitwardenCredentialProviderService::class.java.name,
+                    BitwardenFido2ProviderService::class.java.name,
                    intent,
                )
            } else {
--- a/app/src/main/java/com/x8bit/bitwarden/BitwardenApplication.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/BitwardenApplication.kt
@@ -0,0 +1,35 @@
+package com.x8bit.bitwarden
+
+import android.app.Application
+import com.x8bit.bitwarden.data.auth.manager.AuthRequestNotificationManager
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
+import com.x8bit.bitwarden.data.platform.manager.LogsManager
+import com.x8bit.bitwarden.data.platform.manager.event.OrganizationEventManager
+import com.x8bit.bitwarden.data.platform.manager.network.NetworkConfigManager
+import com.x8bit.bitwarden.data.platform.manager.restriction.RestrictionManager
+import dagger.hilt.android.HiltAndroidApp
+import javax.inject.Inject
+
+/**
+ * Custom application class.
+ */
+@OmitFromCoverage
+@HiltAndroidApp
+class BitwardenApplication : Application() {
+    // Inject classes here that must be triggered on startup but are not otherwise consumed by
+    // other callers.
+    @Inject
+    lateinit var logsManager: LogsManager
+
+    @Inject
+    lateinit var networkConfigManager: NetworkConfigManager
+
+    @Inject
+    lateinit var authRequestNotificationManager: AuthRequestNotificationManager
+
+    @Inject
+    lateinit var organizationEventManager: OrganizationEventManager
+
+    @Inject
+    lateinit var restrictionManager: RestrictionManager
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenLegacyAppComponents.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenLegacyAppComponents.kt
@@ -6,11 +6,6 @@ package com.x8bit.bitwarden
 const val LEGACY_ACCESSIBILITY_SERVICE_NAME: String =
    "com.x8bit.bitwarden.Accessibility.AccessibilityService"

-/**
- * The short form legacy name for the accessibility service.
- */
-const val LEGACY_SHORT_ACCESSIBILITY_SERVICE_NAME: String = ".Accessibility.AccessibilityService"
-
 /**
 * The legacy name for the autofill service.
 */
--- a/app/src/main/java/com/x8bit/bitwarden/MainActivity.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/MainActivity.kt
@@ -0,0 +1,191 @@
+package com.x8bit.bitwarden
+
+import android.content.Intent
+import android.os.Bundle
+import android.view.KeyEvent
+import android.view.MotionEvent
+import android.view.WindowManager
+import android.widget.Toast
+import androidx.activity.compose.setContent
+import androidx.activity.viewModels
+import androidx.appcompat.app.AppCompatActivity
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.remember
+import androidx.core.os.LocaleListCompat
+import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import androidx.navigation.compose.rememberNavController
+import com.x8bit.bitwarden.data.autofill.accessibility.manager.AccessibilityCompletionManager
+import com.x8bit.bitwarden.data.autofill.manager.AutofillActivityManager
+import com.x8bit.bitwarden.data.autofill.manager.AutofillCompletionManager
+import com.x8bit.bitwarden.data.platform.annotation.OmitFromCoverage
+import com.x8bit.bitwarden.data.platform.manager.util.ObserveScreenDataEffect
+import com.x8bit.bitwarden.data.platform.repository.SettingsRepository
+import com.x8bit.bitwarden.ui.platform.base.util.EventsEffect
+import com.x8bit.bitwarden.ui.platform.composition.LocalManagerProvider
+import com.x8bit.bitwarden.ui.platform.feature.debugmenu.manager.DebugMenuLaunchManager
+import com.x8bit.bitwarden.ui.platform.feature.debugmenu.navigateToDebugMenuScreen
+import com.x8bit.bitwarden.ui.platform.feature.rootnav.RootNavScreen
+import com.x8bit.bitwarden.ui.platform.theme.BitwardenTheme
+import dagger.hilt.android.AndroidEntryPoint
+import javax.inject.Inject
+
+/**
+ * Primary entry point for the application.
+ */
+@OmitFromCoverage
+@AndroidEntryPoint
+class MainActivity : AppCompatActivity() {
+
+    private val mainViewModel: MainViewModel by viewModels()
+
+    @Inject
+    lateinit var autofillActivityManager: AutofillActivityManager
+
+    @Inject
+    lateinit var autofillCompletionManager: AutofillCompletionManager
+
+    @Inject
+    lateinit var accessibilityCompletionManager: AccessibilityCompletionManager
+
+    @Inject
+    lateinit var settingsRepository: SettingsRepository
+
+    @Inject
+    lateinit var debugLaunchManager: DebugMenuLaunchManager
+
+    @Suppress("LongMethod")
+    override fun onCreate(savedInstanceState: Bundle?) {
+        var shouldShowSplashScreen = true
+        installSplashScreen().setKeepOnScreenCondition { shouldShowSplashScreen }
+        super.onCreate(savedInstanceState)
+
+        if (savedInstanceState == null) {
+            mainViewModel.trySendAction(
+                MainAction.ReceiveFirstIntent(
+                    intent = intent,
+                ),
+            )
+        }
+
+        // Within the app the language and theme will change dynamically and will be managed by the
+        // OS, but we need to ensure we properly set the values when upgrading from older versions
+        // that handle this differently or when the activity restarts.
+        settingsRepository.appLanguage.localeName?.let { localeName ->
+            val localeList = LocaleListCompat.forLanguageTags(localeName)
+            AppCompatDelegate.setApplicationLocales(localeList)
+        }
+        AppCompatDelegate.setDefaultNightMode(settingsRepository.appTheme.osValue)
+        setContent {
+            val state by mainViewModel.stateFlow.collectAsStateWithLifecycle()
+            val navController = rememberNavController()
+            EventsEffect(viewModel = mainViewModel) { event ->
+                when (event) {
+                    is MainEvent.CompleteAccessibilityAutofill -> {
+                        handleCompleteAccessibilityAutofill(event)
+                    }
+
+                    is MainEvent.CompleteAutofill -> handleCompleteAutofill(event)
+                    MainEvent.Recreate -> handleRecreate()
+                    MainEvent.NavigateToDebugMenu -> navController.navigateToDebugMenuScreen()
+                    is MainEvent.ShowToast -> {
+                        Toast
+                            .makeText(
+                                baseContext,
+                                event.message.invoke(resources),
+                                Toast.LENGTH_SHORT,
+                            )
+                            .show()
+                    }
+
+                    is MainEvent.UpdateAppLocale -> {
+                        AppCompatDelegate.setApplicationLocales(
+                            LocaleListCompat.forLanguageTags(event.localeName),
+                        )
+                    }
+
+                    is MainEvent.UpdateAppTheme -> {
+                        AppCompatDelegate.setDefaultNightMode(event.osTheme)
+                    }
+                }
+            }
+            updateScreenCapture(isScreenCaptureAllowed = state.isScreenCaptureAllowed)
+            LocalManagerProvider {
+                ObserveScreenDataEffect(
+                    onDataUpdate = remember(mainViewModel) {
+                        {
+                            mainViewModel.trySendAction(
+                                MainAction.ResumeScreenDataReceived(it),
+                            )
+                        }
+                    },
+                )
+                BitwardenTheme(theme = state.theme) {
+                    RootNavScreen(
+                        onSplashScreenRemoved = { shouldShowSplashScreen = false },
+                        navController = navController,
+                    )
+                }
+            }
+        }
+    }
+
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        mainViewModel.trySendAction(
+            action = MainAction.ReceiveNewIntent(
+                intent = intent,
+            ),
+        )
+    }
+
+    override fun onStop() {
+        super.onStop()
+        // In some scenarios on an emulator the Activity can leak when recreated
+        // if we don't first clear focus anytime we exit and return to the app.
+        currentFocus?.clearFocus()
+    }
+
+    override fun dispatchTouchEvent(event: MotionEvent): Boolean = debugLaunchManager
+        .actionOnInputEvent(event = event, action = ::sendOpenDebugMenuEvent)
+        .takeIf { it }
+        ?: super.dispatchTouchEvent(event)
+
+    override fun dispatchKeyEvent(event: KeyEvent): Boolean = debugLaunchManager
+        .actionOnInputEvent(event = event, action = ::sendOpenDebugMenuEvent)
+        .takeIf { it }
+        ?: super.dispatchKeyEvent(event)
+
+    private fun sendOpenDebugMenuEvent() {
+        mainViewModel.trySendAction(MainAction.OpenDebugMenu)
+    }
+
+    private fun handleCompleteAccessibilityAutofill(
+        event: MainEvent.CompleteAccessibilityAutofill,
+    ) {
+        accessibilityCompletionManager.completeAccessibilityAutofill(
+            activity = this,
+            cipherView = event.cipherView,
+        )
+    }
+
+    private fun handleCompleteAutofill(event: MainEvent.CompleteAutofill) {
+        autofillCompletionManager.completeAutofill(
+            activity = this,
+            cipherView = event.cipherView,
+        )
+    }
+
+    private fun handleRecreate() {
+        recreate()
+    }
+
+    private fun updateScreenCapture(isScreenCaptureAllowed: Boolean) {
+        if (isScreenCaptureAllowed) {
+            window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        } else {
+            window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        }
+    }
+}
--- a/app/src/main/java/com/x8bit/bitwarden/MainViewModel.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/MainViewModel.kt
@@ -0,0 +1,563 @@
+package com.x8bit.bitwarden
+
+import android.content.Intent
+import android.os.Parcelable
+import androidx.lifecycle.SavedStateHandle
+import androidx.lifecycle.viewModelScope
+import com.bitwarden.vault.CipherView
+import com.x8bit.bitwarden.data.auth.manager.AddTotpItemFromAuthenticatorManager
+import com.x8bit.bitwarden.data.auth.repository.AuthRepository
+import com.x8bit.bitwarden.data.auth.repository.model.EmailTokenResult
+import com.x8bit.bitwarden.data.auth.util.getCompleteRegistrationDataIntentOrNull
+import com.x8bit.bitwarden.data.auth.util.getPasswordlessRequestDataIntentOrNull
+import com.x8bit.bitwarden.data.autofill.accessibility.manager.AccessibilitySelectionManager
+import com.x8bit.bitwarden.data.autofill.fido2.manager.Fido2CredentialManager
+import com.x8bit.bitwarden.data.autofill.fido2.util.getFido2AssertionRequestOrNull
+import com.x8bit.bitwarden.data.autofill.fido2.util.getFido2CreateCredentialRequestOrNull
+import com.x8bit.bitwarden.data.autofill.fido2.util.getFido2GetCredentialsRequestOrNull
+import com.x8bit.bitwarden.data.autofill.manager.AutofillSelectionManager
+import com.x8bit.bitwarden.data.autofill.util.getAutofillSaveItemOrNull
+import com.x8bit.bitwarden.data.autofill.util.getAutofillSelectionDataOrNull
+import com.x8bit.bitwarden.data.platform.manager.AppResumeManager
+import com.x8bit.bitwarden.data.platform.manager.SpecialCircumstanceManager
+import com.x8bit.bitwarden.data.platform.manager.garbage.GarbageCollectionManager
+import com.x8bit.bitwarden.data.platform.manager.model.AppResumeScreenData
+import com.x8bit.bitwarden.data.platform.manager.model.CompleteRegistrationData
+import com.x8bit.bitwarden.data.platform.manager.model.SpecialCircumstance
+import com.x8bit.bitwarden.data.platform.repository.EnvironmentRepository
+import com.x8bit.bitwarden.data.platform.repository.SettingsRepository
+import com.x8bit.bitwarden.data.platform.util.isAddTotpLoginItemFromAuthenticator
+import com.x8bit.bitwarden.data.vault.manager.model.VaultStateEvent
+import com.x8bit.bitwarden.data.vault.repository.VaultRepository
+import com.x8bit.bitwarden.ui.platform.base.BaseViewModel
+import com.x8bit.bitwarden.ui.platform.base.util.Text
+import com.x8bit.bitwarden.ui.platform.base.util.asText
+import com.x8bit.bitwarden.ui.platform.feature.settings.appearance.model.AppTheme
+import com.x8bit.bitwarden.ui.platform.manager.intent.IntentManager
+import com.x8bit.bitwarden.ui.platform.util.isAccountSecurityShortcut
+import com.x8bit.bitwarden.ui.platform.util.isMyVaultShortcut
+import com.x8bit.bitwarden.ui.platform.util.isPasswordGeneratorShortcut
+import com.x8bit.bitwarden.ui.vault.model.TotpData
+import com.x8bit.bitwarden.ui.vault.util.getTotpDataOrNull
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.onEach
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
+import kotlinx.parcelize.Parcelize
+import java.time.Clock
+import javax.inject.Inject
+
+private const val SPECIAL_CIRCUMSTANCE_KEY = "special-circumstance"
+
+/**
+ * A view model that helps launch actions for the [MainActivity].
+ */
+@Suppress("LongParameterList", "TooManyFunctions")
+@HiltViewModel
+class MainViewModel @Inject constructor(
+    accessibilitySelectionManager: AccessibilitySelectionManager,
+    autofillSelectionManager: AutofillSelectionManager,
+    private val addTotpItemFromAuthenticatorManager: AddTotpItemFromAuthenticatorManager,
+    private val specialCircumstanceManager: SpecialCircumstanceManager,
+    private val garbageCollectionManager: GarbageCollectionManager,
+    private val fido2CredentialManager: Fido2CredentialManager,
+    private val intentManager: IntentManager,
+    settingsRepository: SettingsRepository,
+    private val vaultRepository: VaultRepository,
+    private val authRepository: AuthRepository,
+    private val environmentRepository: EnvironmentRepository,
+    private val savedStateHandle: SavedStateHandle,
+    private val appResumeManager: AppResumeManager,
+    private val clock: Clock,
+) : BaseViewModel<MainState, MainEvent, MainAction>(
+    initialState = MainState(
+        theme = settingsRepository.appTheme,
+        isScreenCaptureAllowed = settingsRepository.isScreenCaptureAllowed,
+    ),
+) {
+    private var specialCircumstance: SpecialCircumstance?
+        get() = savedStateHandle[SPECIAL_CIRCUMSTANCE_KEY]
+        set(value) {
+            savedStateHandle[SPECIAL_CIRCUMSTANCE_KEY] = value
+        }
+
+    init {
+        // Immediately restore the special circumstance if we have one and then listen for changes
+        specialCircumstanceManager.specialCircumstance = specialCircumstance
+
+        specialCircumstanceManager
+            .specialCircumstanceStateFlow
+            .onEach { specialCircumstance = it }
+            .launchIn(viewModelScope)
+
+        accessibilitySelectionManager
+            .accessibilitySelectionFlow
+            .map { MainAction.Internal.AccessibilitySelectionReceive(it) }
+            .onEach(::sendAction)
+            .launchIn(viewModelScope)
+
+        autofillSelectionManager
+            .autofillSelectionFlow
+            .onEach { trySendAction(MainAction.Internal.AutofillSelectionReceive(it)) }
+            .launchIn(viewModelScope)
+
+        settingsRepository
+            .appThemeStateFlow
+            .onEach { trySendAction(MainAction.Internal.ThemeUpdate(it)) }
+            .launchIn(viewModelScope)
+        settingsRepository
+            .appLanguageStateFlow
+            .map { MainEvent.UpdateAppLocale(it.localeName) }
+            .onEach(::sendEvent)
+            .launchIn(viewModelScope)
+
+        settingsRepository
+            .isScreenCaptureAllowedStateFlow
+            .map { MainAction.Internal.ScreenCaptureUpdate(it) }
+            .onEach(::trySendAction)
+            .launchIn(viewModelScope)
+
+        authRepository
+            .userStateFlow
+            .drop(count = 1)
+            // Trigger an action whenever the current user changes or we go into/out of a pending
+            // account state (which acts like switching to a temporary user).
+            .map { it?.activeUserId to it?.hasPendingAccountAddition }
+            .distinctUntilChanged()
+            .onEach {
+                // Switching between account states often involves some kind of animation (ex:
+                // account switcher) that we might want to give time to finish before triggering
+                // a refresh.
+                @Suppress("MagicNumber")
+                delay(500)
+                trySendAction(MainAction.Internal.CurrentUserStateChange)
+            }
+            .launchIn(viewModelScope)
+
+        vaultRepository
+            .vaultStateEventFlow
+            .onEach {
+                when (it) {
+                    is VaultStateEvent.Locked -> {
+                        // Similar to account switching, triggering this action too soon can
+                        // interfere with animations or navigation logic, so we will delay slightly.
+                        @Suppress("MagicNumber")
+                        delay(500)
+                        trySendAction(MainAction.Internal.VaultUnlockStateChange)
+                    }
+
+                    is VaultStateEvent.Unlocked -> Unit
+                }
+            }
+            .launchIn(viewModelScope)
+
+        // On app launch, mark all active users as having previously logged in.
+        // This covers any users who are active prior to this value being recorded.
+        viewModelScope.launch {
+            val userState = authRepository
+                .userStateFlow
+                .first()
+            userState
+                ?.accounts
+                ?.forEach {
+                    settingsRepository.storeUserHasLoggedInValue(it.userId)
+                }
+        }
+    }
+
+    override fun handleAction(action: MainAction) {
+        when (action) {
+            is MainAction.Internal.AccessibilitySelectionReceive -> {
+                handleAccessibilitySelectionReceive(action)
+            }
+
+            is MainAction.Internal.AutofillSelectionReceive -> {
+                handleAutofillSelectionReceive(action)
+            }
+
+            is MainAction.Internal.CurrentUserStateChange -> handleCurrentUserStateChange()
+            is MainAction.Internal.ScreenCaptureUpdate -> handleScreenCaptureUpdate(action)
+            is MainAction.Internal.ThemeUpdate -> handleAppThemeUpdated(action)
+            is MainAction.Internal.VaultUnlockStateChange -> handleVaultUnlockStateChange()
+            is MainAction.ReceiveFirstIntent -> handleFirstIntentReceived(action)
+            is MainAction.ReceiveNewIntent -> handleNewIntentReceived(action)
+            MainAction.OpenDebugMenu -> handleOpenDebugMenu()
+            is MainAction.ResumeScreenDataReceived -> handleAppResumeDataUpdated(action)
+        }
+    }
+
+    private fun handleAppResumeDataUpdated(action: MainAction.ResumeScreenDataReceived) {
+        when (val data = action.screenResumeData) {
+            null -> appResumeManager.clearResumeScreen()
+            else -> appResumeManager.setResumeScreen(data)
+        }
+    }
+
+    private fun handleOpenDebugMenu() {
+        sendEvent(MainEvent.NavigateToDebugMenu)
+    }
+
+    private fun handleAccessibilitySelectionReceive(
+        action: MainAction.Internal.AccessibilitySelectionReceive,
+    ) {
+        specialCircumstanceManager.specialCircumstance = null
+        sendEvent(MainEvent.CompleteAccessibilityAutofill(cipherView = action.cipherView))
+    }
+
+    private fun handleAutofillSelectionReceive(
+        action: MainAction.Internal.AutofillSelectionReceive,
+    ) {
+        specialCircumstanceManager.specialCircumstance = null
+        sendEvent(MainEvent.CompleteAutofill(cipherView = action.cipherView))
+    }
+
+    private fun handleCurrentUserStateChange() {
+        recreateUiAndGarbageCollect()
+    }
+
+    private fun handleScreenCaptureUpdate(action: MainAction.Internal.ScreenCaptureUpdate) {
+        mutableStateFlow.update { it.copy(isScreenCaptureAllowed = action.isScreenCaptureEnabled) }
+    }
+
+    private fun handleAppThemeUpdated(action: MainAction.Internal.ThemeUpdate) {
+        mutableStateFlow.update { it.copy(theme = action.theme) }
+        sendEvent(MainEvent.UpdateAppTheme(osTheme = action.theme.osValue))
+    }
+
+    private fun handleVaultUnlockStateChange() {
+        recreateUiAndGarbageCollect()
+    }
+
+    private fun handleFirstIntentReceived(action: MainAction.ReceiveFirstIntent) {
+        handleIntent(
+            intent = action.intent,
+            isFirstIntent = true,
+        )
+    }
+
+    private fun handleNewIntentReceived(action: MainAction.ReceiveNewIntent) {
+        handleIntent(
+            intent = action.intent,
+            isFirstIntent = false,
+        )
+    }
+
+    @Suppress("LongMethod", "CyclomaticComplexMethod")
+    private fun handleIntent(
+        intent: Intent,
+        isFirstIntent: Boolean,
+    ) {
+        val passwordlessRequestData = intent.getPasswordlessRequestDataIntentOrNull()
+        val autofillSaveItem = intent.getAutofillSaveItemOrNull()
+        val autofillSelectionData = intent.getAutofillSelectionDataOrNull()
+        val shareData = intentManager.getShareDataFromIntent(intent)
+        val totpData: TotpData? =
+            // First grab TOTP URI directly from the intent data:
+            intent.getTotpDataOrNull()
+                ?: run {
+                    // Then check to see if the intent is coming from the Authenticator app:
+                    if (intent.isAddTotpLoginItemFromAuthenticator()) {
+                        addTotpItemFromAuthenticatorManager.pendingAddTotpLoginItemData.also {
+                            // Clear pending add TOTP data so it is only handled once:
+                            addTotpItemFromAuthenticatorManager.pendingAddTotpLoginItemData = null
+                        }
+                    } else {
+                        null
+                    }
+                }
+        val hasGeneratorShortcut = intent.isPasswordGeneratorShortcut
+        val hasVaultShortcut = intent.isMyVaultShortcut
+        val hasAccountSecurityShortcut = intent.isAccountSecurityShortcut
+        val fido2CreateCredentialRequestData = intent.getFido2CreateCredentialRequestOrNull()
+        val completeRegistrationData = intent.getCompleteRegistrationDataIntentOrNull()
+        val fido2CredentialAssertionRequest = intent.getFido2AssertionRequestOrNull()
+        val fido2GetCredentialsRequest = intent.getFido2GetCredentialsRequestOrNull()
+        when {
+            passwordlessRequestData != null -> {
+                authRepository.activeUserId?.let {
+                    if (it != passwordlessRequestData.userId &&
+                        !vaultRepository.isVaultUnlocked(it)
+                    ) {
+                        // We only switch the account here if the current user's vault is not
+                        // unlocked, otherwise prompt the user to allow us to change the account
+                        // in the LoginApprovalScreen
+                        authRepository.switchAccount(passwordlessRequestData.userId)
+                    }
+                }
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.PasswordlessRequest(
+                        passwordlessRequestData = passwordlessRequestData,
+                        // Allow users back into the already-running app when completing the
+                        // autofill task when this is not the first intent.
+                        shouldFinishWhenComplete = isFirstIntent,
+                    )
+            }
+
+            completeRegistrationData != null -> {
+                handleCompleteRegistrationData(completeRegistrationData)
+            }
+
+            autofillSaveItem != null -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.AutofillSave(
+                        autofillSaveItem = autofillSaveItem,
+                    )
+            }
+
+            autofillSelectionData != null -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.AutofillSelection(
+                        autofillSelectionData = autofillSelectionData,
+                        // Allow users back into the already-running app when completing the
+                        // autofill task when this is not the first intent.
+                        shouldFinishWhenComplete = isFirstIntent,
+                    )
+            }
+
+            totpData != null -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.AddTotpLoginItem(data = totpData)
+            }
+
+            shareData != null -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.ShareNewSend(
+                        data = shareData,
+                        // Allow users back into the already-running app when completing the
+                        // Send task when this is not the first intent.
+                        shouldFinishWhenComplete = isFirstIntent,
+                    )
+            }
+
+            fido2CreateCredentialRequestData != null -> {
+                // Set the user's verification status when a new FIDO 2 request is received to force
+                // explicit verification if the user's vault is unlocked when the request is
+                // received.
+                fido2CreateCredentialRequestData.isUserVerified
+                    ?.let { isVerified -> fido2CredentialManager.isUserVerified = isVerified }
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.Fido2Save(
+                        fido2CreateCredentialRequest = fido2CreateCredentialRequestData,
+                    )
+
+                // Switch accounts if the selected user is not the active user.
+                if (authRepository.activeUserId != null &&
+                    authRepository.activeUserId != fido2CreateCredentialRequestData.userId
+                ) {
+                    authRepository.switchAccount(fido2CreateCredentialRequestData.userId)
+                }
+            }
+
+            fido2CredentialAssertionRequest != null -> {
+                // If device biometric verification was performed as part of single-tap
+                // authentication, set the user's verification state to the device result.
+                // Otherwise, retain the verification state as-is.
+                fido2CredentialAssertionRequest.isUserVerified
+                    ?.let { isVerified -> fido2CredentialManager.isUserVerified = isVerified }
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.Fido2Assertion(
+                        fido2AssertionRequest = fido2CredentialAssertionRequest,
+                    )
+            }
+
+            fido2GetCredentialsRequest != null -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.Fido2GetCredentials(
+                        fido2GetCredentialsRequest = fido2GetCredentialsRequest,
+                    )
+            }
+
+            hasGeneratorShortcut -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.GeneratorShortcut
+            }
+
+            hasVaultShortcut -> {
+                specialCircumstanceManager.specialCircumstance = SpecialCircumstance.VaultShortcut
+            }
+
+            hasAccountSecurityShortcut -> {
+                specialCircumstanceManager.specialCircumstance =
+                    SpecialCircumstance.AccountSecurityShortcut
+            }
+        }
+    }
+
+    private fun recreateUiAndGarbageCollect() {
+        sendEvent(MainEvent.Recreate)
+        garbageCollectionManager.tryCollect()
+    }
+
+    private fun handleCompleteRegistrationData(data: CompleteRegistrationData) {
+        viewModelScope.launch {
+            // Attempt to load the environment for the user if they have a pre-auth environment
+            // saved.
+            environmentRepository.loadEnvironmentForEmail(userEmail = data.email)
+            // Determine if the token is still valid.
+            val emailTokenResult = authRepository.validateEmailToken(
+                email = data.email,
+                token = data.verificationToken,
+            )
+            when (emailTokenResult) {
+                is EmailTokenResult.Error -> {
+                    sendEvent(
+                        MainEvent.ShowToast(
+                            message = emailTokenResult
+                                .message
+                                ?.asText()
+                                ?: R.string.there_was_an_issue_validating_the_registration_token
+                                    .asText(),
+                        ),
+                    )
+                }
+
+                EmailTokenResult.Expired -> {
+                    specialCircumstanceManager.specialCircumstance = SpecialCircumstance
+                        .RegistrationEvent
+                        .ExpiredRegistrationLink
+                }
+
+                EmailTokenResult.Success -> {
+                    if (authRepository.activeUserId != null) {
+                        authRepository.hasPendingAccountAddition = true
+                    }
+                    specialCircumstanceManager.specialCircumstance =
+                        SpecialCircumstance.RegistrationEvent.CompleteRegistration(
+                            completeRegistrationData = data,
+                            timestamp = clock.millis(),
+                        )
+                }
+            }
+        }
+    }
+}
+
+/**
+ * Models state for the [MainActivity].
+ */
+@Parcelize
+data class MainState(
+    val theme: AppTheme,
+    val isScreenCaptureAllowed: Boolean,
+) : Parcelable
+
+/**
+ * Models actions for the [MainActivity].
+ */
+sealed class MainAction {
+    /**
+     * Receive first Intent by the application.
+     */
+    data class ReceiveFirstIntent(val intent: Intent) : MainAction()
+
+    /**
+     * Receive Intent by the application.
+     */
+    data class ReceiveNewIntent(val intent: Intent) : MainAction()
+
+    /**
+     * Receive event to open the debug menu.
+     */
+    data object OpenDebugMenu : MainAction()
+
+    /**
+     * Receive event to save the app resume screen
+     */
+    data class ResumeScreenDataReceived(val screenResumeData: AppResumeScreenData?) : MainAction()
+
+    /**
+     * Actions for internal use by the ViewModel.
+     */
+    sealed class Internal : MainAction() {
+        /**
+         * Indicates the user has manually selected the given [cipherView] for accessibility
+         * autofill.
+         */
+        data class AccessibilitySelectionReceive(
+            val cipherView: CipherView,
+        ) : Internal()
+
+        /**
+         * Indicates the user has manually selected the given [cipherView] for autofill.
+         */
+        data class AutofillSelectionReceive(
+            val cipherView: CipherView,
+        ) : Internal()
+
+        /**
+         * Indicates a relevant change in the current user state.
+         */
+        data object CurrentUserStateChange : Internal()
+
+        /**
+         * Indicates that the screen capture state has changed.
+         */
+        data class ScreenCaptureUpdate(
+            val isScreenCaptureEnabled: Boolean,
+        ) : Internal()
+
+        /**
+         * Indicates that the app theme has changed.
+         */
+        data class ThemeUpdate(
+            val theme: AppTheme,
+        ) : Internal()
+
+        /**
+         * Indicates a relevant change in the current vault lock state.
+         */
+        data object VaultUnlockStateChange : Internal()
+    }
+}
+
+/**
+ * Represents events that are emitted by the [MainViewModel].
+ */
+sealed class MainEvent {
+    /**
+     * Event indicating that the user has chosen the given [cipherView] for accessibility autofill
+     * and that the process is ready to complete.
+     */
+    data class CompleteAccessibilityAutofill(val cipherView: CipherView) : MainEvent()
+
+    /**
+     * Event indicating that the user has chosen the given [cipherView] for autofill and that the
+     * process is ready to complete.
+     */
+    data class CompleteAutofill(val cipherView: CipherView) : MainEvent()
+
+    /**
+     * Event indicating that the UI should recreate itself.
+     */
+    data object Recreate : MainEvent()
+
+    /**
+     * Navigate to the debug menu.
+     */
+    data object NavigateToDebugMenu : MainEvent()
+
+    /**
+     * Show a toast with the given [message].
+     */
+    data class ShowToast(val message: Text) : MainEvent()
+
+    /**
+     * Indicates that the app language has been updated.
+     */
+    data class UpdateAppLocale(
+        val localeName: String?,
+    ) : MainEvent()
+
+    /**
+     * Indicates that the app theme has been updated.
+     */
+    data class UpdateAppTheme(
+        val osTheme: Int,
+    ) : MainEvent()
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSource.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSource.kt
@@ -1,12 +1,11 @@
 package com.x8bit.bitwarden.data.auth.datasource.disk

-import com.bitwarden.network.model.AccountKeysJson
-import com.bitwarden.network.model.SyncResponseJson
-import com.bitwarden.network.provider.AppIdProvider
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.AccountTokensJson
+import com.x8bit.bitwarden.data.auth.datasource.disk.model.NewDeviceNoticeState
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.OnboardingStatus
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.PendingAuthRequestJson
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.UserStateJson
+import com.x8bit.bitwarden.data.vault.datasource.network.model.SyncResponseJson
 import kotlinx.coroutines.flow.Flow
 import java.time.Instant

@@ -14,7 +13,7 @@ import java.time.Instant
 * Primary access point for disk information.
 */
@Suppress("TooManyFunctions")
-interface AuthDiskSource : AppIdProvider {
+interface AuthDiskSource {

    /**
     * The currently persisted authenticator sync symmetric key. This key is used for
@@ -22,6 +21,13 @@ interface AuthDiskSource : AppIdProvider {
     */
    var authenticatorSyncSymmetricKey: ByteArray?

+    /**
+     * Retrieves a unique ID for the application that is stored locally. This will generate a new
+     * one if it does not yet exist and it will only be reset for new installs or when clearing
+     * application data.
+     */
+    val uniqueAppId: String
+
    /**
     * The currently persisted saved email address (or `null` if not set).
     */
@@ -127,34 +133,13 @@ interface AuthDiskSource : AppIdProvider {
    /**
     * Retrieves a private key using a [userId].
     */
-    @Deprecated(
-        message = "Use getAccountKeys instead.",
-        replaceWith = ReplaceWith("getAccountKeys"),
-    )
    fun getPrivateKey(userId: String): String?

    /**
     * Stores a private key using a [userId].
     */
-    @Deprecated(
-        message = "Use storeAccountKeys instead.",
-        replaceWith = ReplaceWith("storeAccountKeys"),
-    )
    fun storePrivateKey(userId: String, privateKey: String?)

-    /**
-     * Returns the profile account keys for the given [userId].
-     */
-    fun getAccountKeys(userId: String): AccountKeysJson?
-
-    /**
-     * Stores the profile account keys for the given [userId].
-     */
-    fun storeAccountKeys(
-        userId: String,
-        accountKeys: AccountKeysJson?,
-    )
-
    /**
     * Retrieves a user auto-unlock key for the given [userId].
     */
@@ -359,6 +344,16 @@ interface AuthDiskSource : AppIdProvider {
     */
    fun getShowImportLoginsFlow(userId: String): Flow<Boolean?>

+    /**
+     * Gets the new device notice state for the given [userId].
+     */
+    fun getNewDeviceNoticeState(userId: String): NewDeviceNoticeState
+
+    /**
+     * Stores the new device notice state for the given [userId].
+     */
+    fun storeNewDeviceNoticeState(userId: String, newState: NewDeviceNoticeState?)
+
    /**
     * Gets the last lock timestamp for the given [userId].
     */
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSourceImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSourceImpl.kt
@@ -1,16 +1,17 @@
 package com.x8bit.bitwarden.data.auth.datasource.disk

 import android.content.SharedPreferences
-import com.bitwarden.core.data.repository.util.bufferedMutableSharedFlow
-import com.bitwarden.core.data.util.decodeFromStringOrNull
-import com.bitwarden.data.datasource.disk.BaseEncryptedDiskSource
-import com.bitwarden.network.model.AccountKeysJson
-import com.bitwarden.network.model.SyncResponseJson
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.AccountTokensJson
+import com.x8bit.bitwarden.data.auth.datasource.disk.model.NewDeviceNoticeDisplayStatus
+import com.x8bit.bitwarden.data.auth.datasource.disk.model.NewDeviceNoticeState
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.OnboardingStatus
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.PendingAuthRequestJson
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.UserStateJson
+import com.x8bit.bitwarden.data.platform.datasource.disk.BaseEncryptedDiskSource
 import com.x8bit.bitwarden.data.platform.datasource.disk.legacy.LegacySecureStorageMigrator
+import com.x8bit.bitwarden.data.platform.repository.util.bufferedMutableSharedFlow
+import com.x8bit.bitwarden.data.platform.util.decodeFromStringOrNull
+import com.x8bit.bitwarden.data.vault.datasource.network.model.SyncResponseJson
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableSharedFlow
 import kotlinx.coroutines.flow.onSubscription
@@ -48,8 +49,8 @@ private const val TDE_LOGIN_COMPLETE = "tdeLoginComplete"
 private const val USES_KEY_CONNECTOR = "usesKeyConnector"
 private const val ONBOARDING_STATUS_KEY = "onboardingStatus"
 private const val SHOW_IMPORT_LOGINS_KEY = "showImportLogins"
+private const val NEW_DEVICE_NOTICE_STATE = "newDeviceNoticeState"
 private const val LAST_LOCK_TIMESTAMP = "lastLockTimestamp"
-private const val PROFILE_ACCOUNT_KEYS_KEY = "profileAccountKeys"

 /**
 * Primary implementation of [AuthDiskSource].
@@ -144,7 +145,6 @@ class AuthDiskSourceImpl(
        storePinProtectedUserKey(userId = userId, pinProtectedUserKey = null)
        storeEncryptedPin(userId = userId, encryptedPin = null)
        storePrivateKey(userId = userId, privateKey = null)
-        storeAccountKeys(userId = userId, accountKeys = null)
        storeOrganizationKeys(userId = userId, organizationKeys = null)
        storeOrganizations(userId = userId, organizations = null)
        storeUserBiometricInitVector(userId = userId, iv = null)
@@ -231,11 +231,9 @@ class AuthDiskSourceImpl(
        )
    }

-    @Deprecated("Use getAccountKeys instead.", replaceWith = ReplaceWith("getAccountKeys"))
    override fun getPrivateKey(userId: String): String? =
        getString(key = MASTER_KEY_ENCRYPTION_PRIVATE_KEY.appendIdentifier(userId))

-    @Deprecated("Use storeAccountKeys instead.", replaceWith = ReplaceWith("storeAccountKeys"))
    override fun storePrivateKey(userId: String, privateKey: String?) {
        putString(
            key = MASTER_KEY_ENCRYPTION_PRIVATE_KEY.appendIdentifier(userId),
@@ -243,20 +241,6 @@ class AuthDiskSourceImpl(
        )
    }

-    override fun getAccountKeys(userId: String): AccountKeysJson? =
-        getEncryptedString(key = PROFILE_ACCOUNT_KEYS_KEY.appendIdentifier(userId))
-            ?.let { json.decodeFromStringOrNull(it) }
-
-    override fun storeAccountKeys(
-        userId: String,
-        accountKeys: AccountKeysJson?,
-    ) {
-        putEncryptedString(
-            key = PROFILE_ACCOUNT_KEYS_KEY.appendIdentifier(userId),
-            value = accountKeys?.let { json.encodeToString(it) },
-        )
-    }
-
    override fun getUserAutoUnlockKey(userId: String): String? =
        getEncryptedString(
            key = USER_AUTO_UNLOCK_KEY_KEY.appendIdentifier(userId),
@@ -505,6 +489,22 @@ class AuthDiskSourceImpl(
        getMutableShowImportLoginsFlow(userId)
            .onSubscription { emit(getShowImportLogins(userId)) }

+    override fun getNewDeviceNoticeState(userId: String): NewDeviceNoticeState {
+        return getString(key = NEW_DEVICE_NOTICE_STATE.appendIdentifier(userId))?.let {
+            json.decodeFromStringOrNull(it)
+        } ?: NewDeviceNoticeState(
+            displayStatus = NewDeviceNoticeDisplayStatus.HAS_NOT_SEEN,
+            lastSeenDate = null,
+        )
+    }
+
+    override fun storeNewDeviceNoticeState(userId: String, newState: NewDeviceNoticeState?) {
+        putString(
+            key = NEW_DEVICE_NOTICE_STATE.appendIdentifier(userId),
+            value = newState?.let { json.encodeToString(it) },
+        )
+    }
+
    override fun getLastLockTimestamp(userId: String): Instant? {
        return getLong(key = LAST_LOCK_TIMESTAMP.appendIdentifier(userId))?.let {
            Instant.ofEpochMilli(it)
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/di/AuthDiskModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/di/AuthDiskModule.kt
@@ -1,10 +1,10 @@
 package com.x8bit.bitwarden.data.auth.datasource.disk.di

 import android.content.SharedPreferences
-import com.bitwarden.data.datasource.disk.di.EncryptedPreferences
-import com.bitwarden.data.datasource.disk.di.UnencryptedPreferences
 import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
 import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSourceImpl
+import com.x8bit.bitwarden.data.platform.datasource.di.EncryptedPreferences
+import com.x8bit.bitwarden.data.platform.datasource.di.UnencryptedPreferences
 import com.x8bit.bitwarden.data.platform.datasource.disk.legacy.LegacySecureStorageMigrator
 import dagger.Module
 import dagger.Provides
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountJson.kt
@@ -1,8 +1,7 @@
 package com.x8bit.bitwarden.data.auth.datasource.disk.model

-import com.bitwarden.data.datasource.disk.model.EnvironmentUrlDataJson
-import com.bitwarden.network.model.KdfTypeJson
-import com.bitwarden.network.model.UserDecryptionOptionsJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.KdfTypeJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.UserDecryptionOptionsJson
 import kotlinx.serialization.Contextual
 import kotlinx.serialization.ExperimentalSerializationApi
 import kotlinx.serialization.SerialName
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountTokensJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountTokensJson.kt
@@ -2,14 +2,12 @@ package com.x8bit.bitwarden.data.auth.datasource.disk.model

 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
-import java.time.Instant

 /**
 * Container for the user's API tokens.
 *
 * @property accessToken The user's primary access token.
 * @property refreshToken The user's refresh token.
- * @property expiresAtSec The time at which the token expires in epoch seconds.
 */
@Serializable
 data class AccountTokensJson(
@@ -18,9 +16,6 @@ data class AccountTokensJson(

    @SerialName("refreshToken")
    val refreshToken: String?,
-
-    @SerialName("expiresAtSec")
-    val expiresAtSec: Long = Instant.MAX.epochSecond,
 ) {
    /**
     * Returns `true` if the user is logged in, `false otherwise.
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/disk/model/EnvironmentUrlDataJson.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/disk/model/EnvironmentUrlDataJson.kt
@@ -0,0 +1,88 @@
+package com.x8bit.bitwarden.data.auth.datasource.disk.model
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/**
+ * Represents URLs for various Bitwarden domains.
+ *
+ * @property base The overall base URL.
+ * @property keyUri A Uri containing the alias and host of the key used for mutual TLS.
+ * @property api Separate base URL for the "/api" domain (if applicable).
+ * @property identity Separate base URL for the "/identity" domain (if applicable).
+ * @property icon Separate base URL for the icon domain (if applicable).
+ * @property notifications Separate base URL for the notifications domain (if applicable).
+ * @property webVault Separate base URL for the web vault domain (if applicable).
+ * @property events Separate base URL for the events domain (if applicable).
+ */
+@Serializable
+data class EnvironmentUrlDataJson(
+    @SerialName("base")
+    val base: String,
+
+    @SerialName("keyUri")
+    val keyUri: String? = null,
+
+    @SerialName("api")
+    val api: String? = null,
+
+    @SerialName("identity")
+    val identity: String? = null,
+
+    @SerialName("icons")
+    val icon: String? = null,
+
+    @SerialName("notifications")
+    val notifications: String? = null,
+
+    @SerialName("webVault")
+    val webVault: String? = null,
+
+    @SerialName("events")
+    val events: String? = null,
+) {
+    @Suppress("UndocumentedPublicClass")
+    companion object {
+        /**
+         * Default [EnvironmentUrlDataJson] for the US region.
+         */
+        val DEFAULT_US: EnvironmentUrlDataJson =
+            EnvironmentUrlDataJson(base = "https://vault.bitwarden.com")
+
+        /**
+         * Default [EnvironmentUrlDataJson] for the US region as written to disk by the legacy
+         * Xamarin app.
+         */
+        val DEFAULT_LEGACY_US: EnvironmentUrlDataJson = EnvironmentUrlDataJson(
+            base = "https://vault.bitwarden.com",
+            keyUri = null,
+            api = "https://api.bitwarden.com",
+            identity = "https://identity.bitwarden.com",
+            icon = "https://icons.bitwarden.net",
+            notifications = "https://notifications.bitwarden.com",
+            webVault = "https://vault.bitwarden.com",
+            events = "https://events.bitwarden.com",
+        )
+
+        /**
+         * Default [EnvironmentUrlDataJson] for the EU region.
+         */
+        val DEFAULT_EU: EnvironmentUrlDataJson =
+            EnvironmentUrlDataJson(base = "https://vault.bitwarden.eu")
+
+        /**
+         * Default [EnvironmentUrlDataJson] for the EU region as written to disk by the legacy
+         * Xamarin app.
+         */
+        val DEFAULT_LEGACY_EU: EnvironmentUrlDataJson = EnvironmentUrlDataJson(
+            base = "https://vault.bitwarden.eu",
+            keyUri = null,
+            api = "https://api.bitwarden.eu",
+            identity = "https://identity.bitwarden.eu",
+            icon = "https://icons.bitwarden.eu",
+            notifications = "https://notifications.bitwarden.eu",
+            webVault = "https://vault.bitwarden.eu",
+            events = "https://events.bitwarden.eu",
+        )
+    }
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/ForcePasswordResetReason.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/ForcePasswordResetReason.kt
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/disk/model/NewDeviceNoticeDisplayStatus.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/disk/model/NewDeviceNoticeDisplayStatus.kt
@@ -0,0 +1,60 @@
+package com.x8bit.bitwarden.data.auth.datasource.disk.model
+
+import kotlinx.serialization.Contextual
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import java.time.ZonedDateTime
+
+/**
+ * Describes the current display status of the new device notice screen.
+ */
+@Serializable
+enum class NewDeviceNoticeDisplayStatus {
+    /**
+     * The user has seen the screen and indicated they can access their email.
+     */
+    @SerialName("canAccessEmail")
+    CAN_ACCESS_EMAIL,
+
+    /**
+     * The user has indicated they can access their email
+     * as specified by the Permanent mode of the notice.
+     */
+    @SerialName("canAccessEmailPermanent")
+    CAN_ACCESS_EMAIL_PERMANENT,
+
+    /**
+     * The user has not seen the screen.
+     */
+    @SerialName("hasNotSeen")
+    HAS_NOT_SEEN,
+
+    /**
+     * The user has seen the screen and selected "remind me later".
+     */
+    @SerialName("hasSeen")
+    HAS_SEEN,
+}
+
+/**
+ * The state of the new device notice screen.
+ */
+@Suppress("MagicNumber")
+@Serializable
+data class NewDeviceNoticeState(
+    @SerialName("displayStatus")
+    val displayStatus: NewDeviceNoticeDisplayStatus,
+
+    @SerialName("lastSeenDate")
+    @Contextual
+    val lastSeenDate: ZonedDateTime?,
+) {
+    /**
+     * Whether the [lastSeenDate] is at least 7 days old.
+     */
+    val shouldDisplayNoticeIfSeen = lastSeenDate
+        ?.isBefore(
+            ZonedDateTime.now().minusDays(7),
+        )
+        ?: false
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/OnboardingStatus.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/OnboardingStatus.kt
@@ -27,12 +27,6 @@ enum class OnboardingStatus {
    @SerialName("autofillSetup")
    AUTOFILL_SETUP,

-    /**
-     * The user is completing the browser autofill service setup.
-     */
-    @SerialName("browserAutofillSetup")
-    BROWSER_AUTOFILL_SETUP,
-
    /**
     * The user is completing the final step of the onboarding process.
     */
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/PendingAuthRequestJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/PendingAuthRequestJson.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/UserStateJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/UserStateJson.kt
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedAccountsApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedAccountsApi.kt
@@ -0,0 +1,61 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.CreateAccountKeysRequest
+import com.x8bit.bitwarden.data.auth.datasource.network.model.DeleteAccountRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.ResetPasswordRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.SetPasswordRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.VerifyOtpRequestJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.HTTP
+import retrofit2.http.POST
+
+/**
+ * Defines raw calls under the /accounts API with authentication applied.
+ */
+interface AuthenticatedAccountsApi {
+
+    /**
+     * Converts the currently active account to a key-connector account.
+     */
+    @POST("/accounts/convert-to-key-connector")
+    suspend fun convertToKeyConnector(): NetworkResult<Unit>
+
+    /**
+     * Creates the keys for the current account.
+     */
+    @POST("/accounts/keys")
+    suspend fun createAccountKeys(@Body body: CreateAccountKeysRequest): NetworkResult<Unit>
+
+    /**
+     * Deletes the current account.
+     */
+    @HTTP(method = "DELETE", path = "/accounts", hasBody = true)
+    suspend fun deleteAccount(@Body body: DeleteAccountRequestJson): NetworkResult<Unit>
+
+    @POST("/accounts/request-otp")
+    suspend fun requestOtp(): NetworkResult<Unit>
+
+    @POST("/accounts/verify-otp")
+    suspend fun verifyOtp(
+        @Body body: VerifyOtpRequestJson,
+    ): NetworkResult<Unit>
+
+    /**
+     * Resets the temporary password.
+     */
+    @HTTP(method = "PUT", path = "/accounts/update-temp-password", hasBody = true)
+    suspend fun resetTempPassword(@Body body: ResetPasswordRequestJson): NetworkResult<Unit>
+
+    /**
+     * Resets the password.
+     */
+    @HTTP(method = "POST", path = "/accounts/password", hasBody = true)
+    suspend fun resetPassword(@Body body: ResetPasswordRequestJson): NetworkResult<Unit>
+
+    /**
+     * Sets the password.
+     */
+    @POST("/accounts/set-password")
+    suspend fun setPassword(@Body body: SetPasswordRequestJson): NetworkResult<Unit>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedAuthRequestsApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedAuthRequestsApi.kt
@@ -0,0 +1,50 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.AuthRequestRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.AuthRequestUpdateRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.AuthRequestsResponseJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.POST
+import retrofit2.http.PUT
+import retrofit2.http.Path
+
+/**
+ * Defines authenticated raw calls under the /auth-requests API.
+ */
+interface AuthenticatedAuthRequestsApi {
+
+    /**
+     * Notifies the server of a new admin authentication request.
+     */
+    @POST("/auth-requests/admin-request")
+    suspend fun createAdminAuthRequest(
+        @Header("Device-Identifier") deviceIdentifier: String,
+        @Body body: AuthRequestRequestJson,
+    ): NetworkResult<AuthRequestsResponseJson.AuthRequest>
+
+    /**
+     * Updates an authentication request.
+     */
+    @PUT("/auth-requests/{id}")
+    suspend fun updateAuthRequest(
+        @Path("id") userId: String,
+        @Body body: AuthRequestUpdateRequestJson,
+    ): NetworkResult<AuthRequestsResponseJson.AuthRequest>
+
+    /**
+     * Gets a list of auth requests for this device.
+     */
+    @GET("/auth-requests")
+    suspend fun getAuthRequests(): NetworkResult<AuthRequestsResponseJson>
+
+    /**
+     * Retrieves an existing authentication request by ID.
+     */
+    @GET("/auth-requests/{requestId}")
+    suspend fun getAuthRequest(
+        @Path("requestId") requestId: String,
+    ): NetworkResult<AuthRequestsResponseJson.AuthRequest>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedDevicesApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedDevicesApi.kt
@@ -0,0 +1,21 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import androidx.annotation.Keep
+import com.x8bit.bitwarden.data.auth.datasource.network.model.TrustedDeviceKeysRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.TrustedDeviceKeysResponseJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.PUT
+import retrofit2.http.Path
+
+/**
+ * Defines raw calls under the /devices API that require authentication.
+ */
+@Keep
+interface AuthenticatedDevicesApi {
+    @PUT("/devices/{appId}/keys")
+    suspend fun updateTrustedDeviceKeys(
+        @Path(value = "appId") appId: String,
+        @Body request: TrustedDeviceKeysRequestJson,
+    ): NetworkResult<TrustedDeviceKeysResponseJson>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedKeyConnectorApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedKeyConnectorApi.kt
@@ -0,0 +1,20 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import androidx.annotation.Keep
+import com.x8bit.bitwarden.data.auth.datasource.network.model.KeyConnectorMasterKeyRequestJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.POST
+import retrofit2.http.Url
+
+/**
+ * Defines raw calls specific for key connectors that use custom urls.
+ */
+@Keep
+interface AuthenticatedKeyConnectorApi {
+    @POST
+    suspend fun storeMasterKeyToKeyConnector(
+        @Url url: String,
+        @Body body: KeyConnectorMasterKeyRequestJson,
+    ): NetworkResult<Unit>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedOrganizationApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/AuthenticatedOrganizationApi.kt
@@ -0,0 +1,41 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.OrganizationAutoEnrollStatusResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.OrganizationKeysResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.OrganizationResetPasswordEnrollRequestJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.PUT
+import retrofit2.http.Path
+
+/**
+ * Defines raw calls under the authenticated /organizations API.
+ */
+interface AuthenticatedOrganizationApi {
+    /**
+     * Enrolls this user in the organization's password reset.
+     */
+    @PUT("/organizations/{orgId}/users/{userId}/reset-password-enrollment")
+    suspend fun organizationResetPasswordEnroll(
+        @Path("orgId") organizationId: String,
+        @Path("userId") userId: String,
+        @Body body: OrganizationResetPasswordEnrollRequestJson,
+    ): NetworkResult<Unit>
+
+    /**
+     * Checks whether this organization auto enrolls users in password reset.
+     */
+    @GET("/organizations/{identifier}/auto-enroll-status")
+    suspend fun getOrganizationAutoEnrollResponse(
+        @Path("identifier") organizationIdentifier: String,
+    ): NetworkResult<OrganizationAutoEnrollStatusResponseJson>
+
+    /**
+     * Gets the public and private keys for this organization.
+     */
+    @GET("/organizations/{id}/keys")
+    suspend fun getOrganizationKeys(
+        @Path("id") organizationId: String,
+    ): NetworkResult<OrganizationKeysResponseJson>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/HaveIBeenPwnedApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/HaveIBeenPwnedApi.kt
@@ -0,0 +1,19 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import okhttp3.ResponseBody
+import retrofit2.http.GET
+import retrofit2.http.Path
+
+/**
+ * Defines endpoints for the "have I been pwned" API. For docs see
+ * https://haveibeenpwned.com/API/v2.
+ */
+interface HaveIBeenPwnedApi {
+
+    @GET("/range/{hashPrefix}")
+    suspend fun fetchBreachedPasswords(
+        @Path("hashPrefix")
+        hashPrefix: String,
+    ): NetworkResult<ResponseBody>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedAccountsApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedAccountsApi.kt
@@ -0,0 +1,37 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.KeyConnectorKeyRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.PasswordHintRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.ResendEmailRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.ResendNewDeviceOtpRequestJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import com.x8bit.bitwarden.data.platform.datasource.network.util.HEADER_KEY_AUTHORIZATION
+import retrofit2.http.Body
+import retrofit2.http.Header
+import retrofit2.http.POST
+
+/**
+ * Defines raw calls under the /accounts API.
+ */
+interface UnauthenticatedAccountsApi {
+    @POST("/accounts/password-hint")
+    suspend fun passwordHintRequest(
+        @Body body: PasswordHintRequestJson,
+    ): NetworkResult<Unit>
+
+    @POST("/two-factor/send-email-login")
+    suspend fun resendVerificationCodeEmail(
+        @Body body: ResendEmailRequestJson,
+    ): NetworkResult<Unit>
+
+    @POST("/accounts/set-key-connector-key")
+    suspend fun setKeyConnectorKey(
+        @Body body: KeyConnectorKeyRequestJson,
+        @Header(HEADER_KEY_AUTHORIZATION) bearerToken: String,
+    ): NetworkResult<Unit>
+
+    @POST("/accounts/resend-new-device-otp")
+    suspend fun resendNewDeviceOtp(
+        @Body body: ResendNewDeviceOtpRequestJson,
+    ): NetworkResult<Unit>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedAuthRequestsApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedAuthRequestsApi.kt
@@ -0,0 +1,35 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.AuthRequestRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.AuthRequestsResponseJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.POST
+import retrofit2.http.Path
+import retrofit2.http.Query
+
+/**
+ * Defines unauthenticated raw calls under the /auth-requests API.
+ */
+interface UnauthenticatedAuthRequestsApi {
+
+    /**
+     * Notifies the server of a new authentication request.
+     */
+    @POST("/auth-requests")
+    suspend fun createAuthRequest(
+        @Header("Device-Identifier") deviceIdentifier: String,
+        @Body body: AuthRequestRequestJson,
+    ): NetworkResult<AuthRequestsResponseJson.AuthRequest>
+
+    /**
+     * Queries for updates to a given auth request.
+     */
+    @GET("/auth-requests/{requestId}/response")
+    suspend fun getAuthRequestUpdate(
+        @Path("requestId") requestId: String,
+        @Query("code") accessCode: String,
+    ): NetworkResult<AuthRequestsResponseJson.AuthRequest>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedDevicesApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedDevicesApi.kt
@@ -0,0 +1,16 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.GET
+import retrofit2.http.Header
+
+/**
+ * Defines raw calls under the /devices API that do not require authentication.
+ */
+interface UnauthenticatedDevicesApi {
+    @GET("/devices/knowndevice")
+    suspend fun getIsKnownDevice(
+        @Header(value = "X-Request-Email") emailAddress: String,
+        @Header(value = "X-Device-Identifier") deviceId: String,
+    ): NetworkResult<Boolean>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedIdentityApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedIdentityApi.kt
@@ -0,0 +1,92 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.GetTokenResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.PreLoginRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.PreLoginResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.PrevalidateSsoResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.RefreshTokenResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.RegisterFinishRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.RegisterRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.RegisterResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.SendVerificationEmailRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.VerifyEmailTokenRequestJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import kotlinx.serialization.json.JsonPrimitive
+import retrofit2.Call
+import retrofit2.http.Body
+import retrofit2.http.Field
+import retrofit2.http.FormUrlEncoded
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.POST
+import retrofit2.http.Query
+
+/**
+ * Defines raw calls under the /identity API.
+ */
+interface UnauthenticatedIdentityApi {
+
+    @POST("/connect/token")
+    @Suppress("LongParameterList")
+    @FormUrlEncoded
+    suspend fun getToken(
+        @Field(value = "scope", encoded = true) scope: String,
+        @Field(value = "client_id") clientId: String,
+        @Field(value = "username") email: String,
+        @Header(value = "Auth-Email") authEmail: String,
+        @Field(value = "password") passwordHash: String?,
+        @Field(value = "deviceIdentifier") deviceIdentifier: String,
+        @Field(value = "deviceName") deviceName: String,
+        @Field(value = "deviceType") deviceType: String,
+        @Field(value = "grant_type") grantType: String,
+        @Field(value = "captchaResponse") captchaResponse: String?,
+        @Field(value = "code") ssoCode: String?,
+        @Field(value = "code_verifier") ssoCodeVerifier: String?,
+        @Field(value = "redirect_uri") ssoRedirectUri: String?,
+        @Field(value = "twoFactorToken") twoFactorCode: String?,
+        @Field(value = "twoFactorProvider") twoFactorMethod: String?,
+        @Field(value = "twoFactorRemember") twoFactorRemember: String?,
+        @Field(value = "authRequest") authRequestId: String?,
+        @Field(value = "newDeviceOtp") newDeviceOtp: String?,
+    ): NetworkResult<GetTokenResponseJson.Success>
+
+    @GET("/sso/prevalidate")
+    suspend fun prevalidateSso(
+        @Query("domainHint") organizationIdentifier: String,
+    ): NetworkResult<PrevalidateSsoResponseJson.Success>
+
+    /**
+     * This call needs to be synchronous so we need it to return a [Call] directly. The identity
+     * service will wrap it up for us.
+     */
+    @POST("/connect/token")
+    @FormUrlEncoded
+    fun refreshTokenCall(
+        @Field(value = "client_id") clientId: String,
+        @Field(value = "refresh_token") refreshToken: String,
+        @Field(value = "grant_type") grantType: String,
+    ): Call<RefreshTokenResponseJson>
+
+    @POST("/accounts/prelogin")
+    suspend fun preLogin(@Body body: PreLoginRequestJson): NetworkResult<PreLoginResponseJson>
+
+    @POST("/accounts/register")
+    suspend fun register(
+        @Body body: RegisterRequestJson,
+    ): NetworkResult<RegisterResponseJson.Success>
+
+    @POST("/accounts/register/finish")
+    suspend fun registerFinish(
+        @Body body: RegisterFinishRequestJson,
+    ): NetworkResult<RegisterResponseJson.Success>
+
+    @POST("/accounts/register/send-verification-email")
+    suspend fun sendVerificationEmail(
+        @Body body: SendVerificationEmailRequestJson,
+    ): NetworkResult<JsonPrimitive?>
+
+    @POST("/accounts/register/verification-email-clicked")
+    suspend fun verifyEmailToken(
+        @Body body: VerifyEmailTokenRequestJson,
+    ): NetworkResult<Unit>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedKeyConnectorApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedKeyConnectorApi.kt
@@ -0,0 +1,31 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import androidx.annotation.Keep
+import com.x8bit.bitwarden.data.auth.datasource.network.model.KeyConnectorMasterKeyRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.KeyConnectorMasterKeyResponseJson
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import com.x8bit.bitwarden.data.platform.datasource.network.util.HEADER_KEY_AUTHORIZATION
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.POST
+import retrofit2.http.Url
+
+/**
+ * Defines raw calls specific for key connectors that use custom urls.
+ */
+@Keep
+interface UnauthenticatedKeyConnectorApi {
+    @POST
+    suspend fun storeMasterKeyToKeyConnector(
+        @Url url: String,
+        @Header(HEADER_KEY_AUTHORIZATION) bearerToken: String,
+        @Body body: KeyConnectorMasterKeyRequestJson,
+    ): NetworkResult<Unit>
+
+    @GET
+    suspend fun getMasterKeyFromKeyConnector(
+        @Url url: String,
+        @Header(HEADER_KEY_AUTHORIZATION) bearerToken: String,
+    ): NetworkResult<KeyConnectorMasterKeyResponseJson>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedOrganizationApi.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/api/UnauthenticatedOrganizationApi.kt
@@ -0,0 +1,30 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.api
+
+import com.x8bit.bitwarden.data.auth.datasource.network.model.OrganizationDomainSsoDetailsRequestJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.OrganizationDomainSsoDetailsResponseJson
+import com.x8bit.bitwarden.data.auth.datasource.network.model.VerifiedOrganizationDomainSsoDetailsRequest
+import com.x8bit.bitwarden.data.auth.datasource.network.model.VerifiedOrganizationDomainSsoDetailsResponse
+import com.x8bit.bitwarden.data.platform.datasource.network.model.NetworkResult
+import retrofit2.http.Body
+import retrofit2.http.POST
+
+/**
+ * Defines raw calls under the /organizations API.
+ */
+interface UnauthenticatedOrganizationApi {
+    /**
+     * Checks for the claimed domain organization of an email for SSO purposes.
+     */
+    @POST("/organizations/domain/sso/details")
+    suspend fun getClaimedDomainOrganizationDetails(
+        @Body body: OrganizationDomainSsoDetailsRequestJson,
+    ): NetworkResult<OrganizationDomainSsoDetailsResponseJson>
+
+    /**
+     * Checks for the verfied organization domains of an email for SSO purposes.
+     */
+    @POST("/organizations/domain/sso/verified")
+    suspend fun getVerifiedOrganizationDomainsByEmail(
+        @Body body: VerifiedOrganizationDomainSsoDetailsRequest,
+    ): NetworkResult<VerifiedOrganizationDomainSsoDetailsResponse>
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/di/AuthNetworkModule.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/di/AuthNetworkModule.kt
@@ -0,0 +1,102 @@
+package com.x8bit.bitwarden.data.auth.datasource.network.di
+
+import com.x8bit.bitwarden.data.auth.datasource.network.service.AccountsService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.AccountsServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.AuthRequestsService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.AuthRequestsServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.DevicesService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.DevicesServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.HaveIBeenPwnedService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.HaveIBeenPwnedServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.IdentityService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.IdentityServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.NewAuthRequestService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.NewAuthRequestServiceImpl
+import com.x8bit.bitwarden.data.auth.datasource.network.service.OrganizationService
+import com.x8bit.bitwarden.data.auth.datasource.network.service.OrganizationServiceImpl
+import com.x8bit.bitwarden.data.platform.datasource.network.retrofit.Retrofits
+import dagger.Module
+import dagger.Provides
+import dagger.hilt.InstallIn
+import dagger.hilt.components.SingletonComponent
+import kotlinx.serialization.json.Json
+import retrofit2.create
+import javax.inject.Singleton
+
+/**
+ * Provides network dependencies in the auth package.
+ */
+@Module
+@InstallIn(SingletonComponent::class)
+object AuthNetworkModule {
+
+    @Provides
+    @Singleton
+    fun providesAccountService(
+        retrofits: Retrofits,
+        json: Json,
+    ): AccountsService = AccountsServiceImpl(
+        unauthenticatedAccountsApi = retrofits.unauthenticatedApiRetrofit.create(),
+        authenticatedAccountsApi = retrofits.authenticatedApiRetrofit.create(),
+        unauthenticatedKeyConnectorApi = retrofits.createStaticRetrofit().create(),
+        authenticatedKeyConnectorApi = retrofits
+            .createStaticRetrofit(isAuthenticated = true)
+            .create(),
+        json = json,
+    )
+
+    @Provides
+    @Singleton
+    fun providesAuthRequestsService(
+        retrofits: Retrofits,
+    ): AuthRequestsService = AuthRequestsServiceImpl(
+        authenticatedAuthRequestsApi = retrofits.authenticatedApiRetrofit.create(),
+    )
+
+    @Provides
+    @Singleton
+    fun providesDevicesService(
+        retrofits: Retrofits,
+    ): DevicesService = DevicesServiceImpl(
+        authenticatedDevicesApi = retrofits.authenticatedApiRetrofit.create(),
+        unauthenticatedDevicesApi = retrofits.unauthenticatedApiRetrofit.create(),
+    )
+
+    @Provides
+    @Singleton
+    fun providesIdentityService(
+        retrofits: Retrofits,
+        json: Json,
+    ): IdentityService = IdentityServiceImpl(
+        unauthenticatedIdentityApi = retrofits.unauthenticatedIdentityRetrofit.create(),
+        json = json,
+    )
+
+    @Provides
+    @Singleton
+    fun providesHaveIBeenPwnedService(
+        retrofits: Retrofits,
+    ): HaveIBeenPwnedService = HaveIBeenPwnedServiceImpl(
+        api = retrofits
+            .createStaticRetrofit(baseUrl = "https://api.pwnedpasswords.com")
+            .create(),
+    )
+
+    @Provides
+    @Singleton
+    fun providesNewAuthRequestService(
+        retrofits: Retrofits,
+    ): NewAuthRequestService = NewAuthRequestServiceImpl(
+        authenticatedAuthRequestsApi = retrofits.authenticatedApiRetrofit.create(),
+        unauthenticatedAuthRequestsApi = retrofits.unauthenticatedApiRetrofit.create(),
+    )
+
+    @Provides
+    @Singleton
+    fun providesOrganizationService(
+        retrofits: Retrofits,
+    ): OrganizationService = OrganizationServiceImpl(
+        authenticatedOrganizationApi = retrofits.authenticatedApiRetrofit.create(),
+        unauthenticatedOrganizationApi = retrofits.unauthenticatedApiRetrofit.create(),
+    )
+}
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/model/AuthRequestRequestJson.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/datasource/network/model/AuthRequestRequestJson.kt
@@ -1,4 +1,4 @@
-package com.bitwarden.network.model
+package com.x8bit.bitwarden.data.auth.datasource.network.model

 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Álison Fernandes	bf2ac7cac9	Add pyproject.toml	2025-03-03 16:57:12 +00:00
Álison Fernandes	5bbbf7c5e4	Add script and tests for linked issues, removing method from the release notes script	2025-03-03 16:52:43 +00:00
Álison Fernandes	39d10fa77d	Add release notes processing script and unit tests	2025-03-03 15:44:11 +00:00
Álison Fernandes	f0f240f8e5	Update gitignore for python	2025-03-03 15:43:27 +00:00
@@ -1 +1 @@
 .4.2
 .3.1