# File-first package upload

Selecting a file immediately uploads it to the data service through the MVC portal. The progress bar measures browser upload bytes, then switches to an indeterminate parsing and signature-verification stage. Saving the build does not upload the file a second time.

APK metadata includes the embedded application label, package ID, version name and code, minimum SDK and signing identity. Native A10 metadata comes from the signed nested application archive: `cfg/appname.txt` provides the display name and `cfg/version.txt` provides the version; the exact `tar.gz` remains unchanged. Packages created before `cfg/appname.txt` was introduced retain the `UIC Payment` fallback. The portal fills the display name and build name; package identity and version remain read-only. Only Android model choices are displayed for APKs; Linux ZIPs and A10 packages expose Linux models. The data service independently validates model platforms when saving.

Icons are read from embedded PNG resources (up to 256 KiB), or converted from simple Android vector paths into generated SVG with restricted path and color attributes. Adaptive icons, resource-dependent vectors and other unsupported drawables show an explicit fallback notice. New catalog entries retain supported extracted icons in artifact storage; existing entries require a new upload to acquire an icon.

Uploads are scoped to the authenticated operator and customer, expire after one hour, and are consumed once on save. Pending state currently lives in the data service process: after a restart, select the package again. A background cleanup removes expired unsaved packages and icon sidecars; committed artifacts are checked before deletion. Release remains an explicit subsequent review step. Existing 128 MiB package and archive-expansion limits remain enforced.

Validation: 128 integration checks passed, including staged metadata/vector icon extraction, no catalog publication during inspection, server rejection of Linux targets for APKs, customer isolation, and duplicate-save prevention. Browser verification used UIC Device Lab 1.0.0, confirming automatic metadata/icon preview, progress state and responsive phone layout. No deployment was created by this verification.