diff --git a/Android.bp b/Android.bp
index 591e5c8..92a6e9d 100644
--- a/Android.bp
+++ b/Android.bp
@@ -251,6 +251,7 @@
         "java/gen.go",
         "java/genrule.go",
         "java/hiddenapi.go",
+        "java/hiddenapi_singleton.go",
         "java/jacoco.go",
         "java/java.go",
         "java/jdeps.go",
diff --git a/android/config.go b/android/config.go
index 92010fc..63788b7 100644
--- a/android/config.go
+++ b/android/config.go
@@ -1022,14 +1022,14 @@
 	return c.productVariables.EnforceSystemCertificateWhitelist
 }
 
-func (c *config) HiddenAPIStubFlags() string {
-	return String(c.productVariables.HiddenAPIStubFlags)
+func (c *config) ProductHiddenAPIStubs() []string {
+	return c.productVariables.ProductHiddenAPIStubs
 }
 
-func (c *config) HiddenAPIFlags() string {
-	return String(c.productVariables.HiddenAPIFlags)
+func (c *config) ProductHiddenAPIStubsSystem() []string {
+	return c.productVariables.ProductHiddenAPIStubsSystem
 }
 
-func (c *config) HiddenAPIExtraAppUsageJars() []string {
-	return c.productVariables.HiddenAPIExtraAppUsageJars
+func (c *config) ProductHiddenAPIStubsTest() []string {
+	return c.productVariables.ProductHiddenAPIStubsTest
 }
diff --git a/android/rule_builder.go b/android/rule_builder.go
index d005839..38018be 100644
--- a/android/rule_builder.go
+++ b/android/rule_builder.go
@@ -31,6 +31,7 @@
 	installs       []RuleBuilderInstall
 	temporariesSet map[string]bool
 	restat         bool
+	missingDeps    []string
 }
 
 // NewRuleBuilder returns a newly created RuleBuilder.
@@ -45,6 +46,15 @@
 	From, To string
 }
 
+// MissingDeps adds modules to the list of missing dependencies.  If MissingDeps
+// is called with a non-empty input, any call to Build will result in a rule
+// that will print an error listing the missing dependencies and fail.
+// MissingDeps should only be called if Config.AllowMissingDependencies() is
+// true.
+func (r *RuleBuilder) MissingDeps(missingDeps []string) {
+	r.missingDeps = append(r.missingDeps, missingDeps...)
+}
+
 // Restat marks the rule as a restat rule, which will be passed to ModuleContext.Rule in BuildParams.Restat.
 func (r *RuleBuilder) Restat() *RuleBuilder {
 	r.restat = true
@@ -219,6 +229,18 @@
 		}
 	}
 
+	if len(r.missingDeps) > 0 {
+		ctx.Build(pctx, BuildParams{
+			Rule:        ErrorRule,
+			Outputs:     outputs,
+			Description: desc,
+			Args: map[string]string{
+				"error": "missing dependencies: " + strings.Join(r.missingDeps, ", "),
+			},
+		})
+		return
+	}
+
 	if len(r.Commands()) > 0 {
 		ctx.Build(pctx, BuildParams{
 			Rule: ctx.Rule(pctx, name, blueprint.RuleParams{
diff --git a/android/variable.go b/android/variable.go
index f38cf25..dc880b8 100644
--- a/android/variable.go
+++ b/android/variable.go
@@ -278,10 +278,9 @@
 	EnforceSystemCertificate          *bool    `json:",omitempty"`
 	EnforceSystemCertificateWhitelist []string `json:",omitempty"`
 
-	// TODO(ccross): move these to a Singleton in Soong
-	HiddenAPIStubFlags         *string  `json:",omitempty"`
-	HiddenAPIFlags             *string  `json:",omitempty"`
-	HiddenAPIExtraAppUsageJars []string `json:",omitempty"`
+	ProductHiddenAPIStubs       []string `json:",omitempty"`
+	ProductHiddenAPIStubsSystem []string `json:",omitempty"`
+	ProductHiddenAPIStubsTest   []string `json:",omitempty"`
 }
 
 func boolPtr(v bool) *bool {
diff --git a/cc/cc.go b/cc/cc.go
index 02f36d5..c09a2f3 100644
--- a/cc/cc.go
+++ b/cc/cc.go
@@ -1378,6 +1378,7 @@
 		// NDK code linking to platform code is never okay.
 		ctx.ModuleErrorf("depends on non-NDK-built library %q",
 			ctx.OtherModuleName(to))
+		return
 	}
 
 	// At this point we know we have two NDK libraries, but we need to
diff --git a/java/aar.go b/java/aar.go
index b96f127..b01962a 100644
--- a/java/aar.go
+++ b/java/aar.go
@@ -563,6 +563,10 @@
 	return android.Paths{a.classpathFile}
 }
 
+func (a *AARImport) DexJar() android.Path {
+	return nil
+}
+
 func (a *AARImport) AidlIncludeDirs() android.Paths {
 	return nil
 }
diff --git a/java/config/config.go b/java/config/config.go
index 5c838a5..75be9e2 100644
--- a/java/config/config.go
+++ b/java/config/config.go
@@ -33,6 +33,12 @@
 	DefaultLambdaStubsLibrary     = "core-lambda-stubs"
 	SdkLambdaStubsPath            = "prebuilts/sdk/tools/core-lambda-stubs.jar"
 
+	// A list of the jars that provide information about usages of the hidden API.
+	HiddenAPIExtraAppUsageJars = []string{
+		// The core-oj-hiddenapi provides information for the core-oj jar.
+		"core-oj-hiddenapi",
+	}
+
 	DefaultJacocoExcludeFilter = []string{"org.junit.*", "org.jacoco.*", "org.mockito.*"}
 
 	InstrumentFrameworkModules = []string{
@@ -107,6 +113,7 @@
 	pctx.HostBinToolVariable("ApiCheckCmd", "apicheck")
 	pctx.HostBinToolVariable("D8Cmd", "d8")
 	pctx.HostBinToolVariable("R8Cmd", "r8-compat-proguard")
+	pctx.HostBinToolVariable("HiddenAPICmd", "hiddenapi")
 
 	pctx.VariableFunc("TurbineJar", func(ctx android.PackageVarContext) string {
 		turbine := "turbine.jar"
diff --git a/java/hiddenapi.go b/java/hiddenapi.go
index c7eac73..f199051 100644
--- a/java/hiddenapi.go
+++ b/java/hiddenapi.go
@@ -16,13 +16,11 @@
 
 import (
 	"path/filepath"
-	"sort"
-	"strings"
-	"sync"
 
 	"github.com/google/blueprint"
 
 	"android/soong/android"
+	"android/soong/java/config"
 )
 
 var hiddenAPIGenerateCSVRule = pctx.AndroidStaticRule("hiddenAPIGenerateCSV", blueprint.RuleParams{
@@ -30,10 +28,60 @@
 	CommandDeps: []string{"${config.Class2Greylist}"},
 }, "outFlag", "stubAPIFlags")
 
-func hiddenAPIGenerateCSV(ctx android.ModuleContext, classesJar android.Path) {
-	flagsCSV := android.PathForModuleOut(ctx, "hiddenapi", "flags.csv")
-	metadataCSV := android.PathForModuleOut(ctx, "hiddenapi", "metadata.csv")
-	stubFlagsCSV := &hiddenAPIPath{ctx.Config().HiddenAPIStubFlags()}
+type hiddenAPI struct {
+	flagsCSVPath    android.Path
+	metadataCSVPath android.Path
+	bootDexJarPath  android.Path
+}
+
+func (h *hiddenAPI) flagsCSV() android.Path {
+	return h.flagsCSVPath
+}
+
+func (h *hiddenAPI) metadataCSV() android.Path {
+	return h.metadataCSVPath
+}
+
+func (h *hiddenAPI) bootDexJar() android.Path {
+	return h.bootDexJarPath
+}
+
+type hiddenAPIIntf interface {
+	flagsCSV() android.Path
+	metadataCSV() android.Path
+	bootDexJar() android.Path
+}
+
+var _ hiddenAPIIntf = (*hiddenAPI)(nil)
+
+func (h *hiddenAPI) hiddenAPI(ctx android.ModuleContext, dexJar android.ModuleOutPath, implementationJar android.Path,
+	uncompressDex bool) android.ModuleOutPath {
+
+	if !ctx.Config().IsEnvTrue("UNSAFE_DISABLE_HIDDENAPI_FLAGS") {
+		isBootJar := inList(ctx.ModuleName(), ctx.Config().BootJars())
+		if isBootJar || inList(ctx.ModuleName(), config.HiddenAPIExtraAppUsageJars) {
+			// Derive the greylist from classes jar.
+			flagsCSV := android.PathForModuleOut(ctx, "hiddenapi", "flags.csv")
+			metadataCSV := android.PathForModuleOut(ctx, "hiddenapi", "metadata.csv")
+			hiddenAPIGenerateCSV(ctx, flagsCSV, metadataCSV, implementationJar)
+			h.flagsCSVPath = flagsCSV
+			h.metadataCSVPath = metadataCSV
+		}
+		if isBootJar {
+			hiddenAPIJar := android.PathForModuleOut(ctx, "hiddenapi", ctx.ModuleName()+".jar")
+			h.bootDexJarPath = dexJar
+			hiddenAPIEncodeDex(ctx, hiddenAPIJar, dexJar, uncompressDex)
+			dexJar = hiddenAPIJar
+		}
+	}
+
+	return dexJar
+}
+
+func hiddenAPIGenerateCSV(ctx android.ModuleContext, flagsCSV, metadataCSV android.WritablePath,
+	classesJar android.Path) {
+
+	stubFlagsCSV := hiddenAPISingletonPaths(ctx).stubFlags
 
 	ctx.Build(pctx, android.BuildParams{
 		Rule:        hiddenAPIGenerateCSVRule,
@@ -59,7 +107,6 @@
 		},
 	})
 
-	hiddenAPISaveCSVOutputs(ctx, flagsCSV, metadataCSV)
 }
 
 var hiddenAPIEncodeDexRule = pctx.AndroidStaticRule("hiddenAPIEncodeDex", blueprint.RuleParams{
@@ -78,10 +125,10 @@
 	},
 }, "flagsCsv", "hiddenapiFlags", "tmpDir", "soongZipFlags")
 
-func hiddenAPIEncodeDex(ctx android.ModuleContext, output android.WritablePath, dexInput android.WritablePath,
+func hiddenAPIEncodeDex(ctx android.ModuleContext, output android.WritablePath, dexInput android.Path,
 	uncompressDex bool) {
 
-	flagsCsv := &hiddenAPIPath{ctx.Config().HiddenAPIFlags()}
+	flagsCSV := hiddenAPISingletonPaths(ctx).flags
 
 	// The encode dex rule requires unzipping and rezipping the classes.dex files, ensure that if it was uncompressed
 	// in the input it stays uncompressed in the output.
@@ -105,9 +152,9 @@
 		Description: "hiddenapi encode dex",
 		Input:       dexInput,
 		Output:      tmpOutput,
-		Implicit:    flagsCsv,
+		Implicit:    flagsCSV,
 		Args: map[string]string{
-			"flagsCsv":       flagsCsv.String(),
+			"flagsCsv":       flagsCSV.String(),
 			"tmpDir":         tmpDir.String(),
 			"soongZipFlags":  soongZipFlags,
 			"hiddenapiFlags": hiddenapiFlags,
@@ -117,57 +164,6 @@
 	if uncompressDex {
 		TransformZipAlign(ctx, output, tmpOutput)
 	}
-
-	hiddenAPISaveDexInputs(ctx, dexInput)
-}
-
-var hiddenAPIOutputsKey = android.NewOnceKey("hiddenAPIOutputsKey")
-
-var hiddenAPIOutputsLock sync.Mutex
-
-func hiddenAPIGetOutputs(config android.Config) (*android.Paths, *android.Paths, *android.Paths) {
-	type threePathsPtrs [3]*android.Paths
-	s := config.Once(hiddenAPIOutputsKey, func() interface{} {
-		return threePathsPtrs{new(android.Paths), new(android.Paths), new(android.Paths)}
-	}).(threePathsPtrs)
-	return s[0], s[1], s[2]
-}
-
-func hiddenAPISaveCSVOutputs(ctx android.ModuleContext, flagsCSV, metadataCSV android.Path) {
-	flagsCSVList, metadataCSVList, _ := hiddenAPIGetOutputs(ctx.Config())
-
-	hiddenAPIOutputsLock.Lock()
-	defer hiddenAPIOutputsLock.Unlock()
-
-	*flagsCSVList = append(*flagsCSVList, flagsCSV)
-	*metadataCSVList = append(*metadataCSVList, metadataCSV)
-}
-
-func hiddenAPISaveDexInputs(ctx android.ModuleContext, dexInput android.Path) {
-	_, _, dexInputList := hiddenAPIGetOutputs(ctx.Config())
-
-	hiddenAPIOutputsLock.Lock()
-	defer hiddenAPIOutputsLock.Unlock()
-
-	*dexInputList = append(*dexInputList, dexInput)
-}
-
-func init() {
-	android.RegisterMakeVarsProvider(pctx, hiddenAPIMakeVars)
-}
-
-func hiddenAPIMakeVars(ctx android.MakeVarsContext) {
-	flagsCSVList, metadataCSVList, dexInputList := hiddenAPIGetOutputs(ctx.Config())
-
-	export := func(name string, paths *android.Paths) {
-		s := paths.Strings()
-		sort.Strings(s)
-		ctx.Strict(name, strings.Join(s, " "))
-	}
-
-	export("SOONG_HIDDENAPI_FLAGS", flagsCSVList)
-	export("SOONG_HIDDENAPI_GREYLIST_METADATA", metadataCSVList)
-	export("SOONG_HIDDENAPI_DEX_INPUTS", dexInputList)
 }
 
 type hiddenAPIPath struct {
diff --git a/java/hiddenapi_singleton.go b/java/hiddenapi_singleton.go
new file mode 100644
index 0000000..96de755
--- /dev/null
+++ b/java/hiddenapi_singleton.go
@@ -0,0 +1,290 @@
+// Copyright 2019 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package java
+
+import (
+	"android/soong/android"
+)
+
+func init() {
+	android.RegisterSingletonType("hiddenapi", hiddenAPISingletonFactory)
+}
+
+type hiddenAPISingletonPathsStruct struct {
+	stubFlags android.OutputPath
+	flags     android.OutputPath
+	metadata  android.OutputPath
+}
+
+var hiddenAPISingletonPathsKey = android.NewOnceKey("hiddenAPISingletonPathsKey")
+
+// hiddenAPISingletonPaths creates all the paths for singleton files the first time it is called, which may be
+// from a ModuleContext that needs to reference a file that will be created by a singleton rule that hasn't
+// yet been created.
+func hiddenAPISingletonPaths(ctx android.PathContext) hiddenAPISingletonPathsStruct {
+	return ctx.Config().Once(hiddenAPISingletonPathsKey, func() interface{} {
+		return hiddenAPISingletonPathsStruct{
+			stubFlags: android.PathForOutput(ctx, "hiddenapi", "hiddenapi-stub-flags.txt"),
+			flags:     android.PathForOutput(ctx, "hiddenapi", "hiddenapi-flags.csv"),
+			metadata:  android.PathForOutput(ctx, "hiddenapi", "hiddenapi-greylist.csv"),
+		}
+	}).(hiddenAPISingletonPathsStruct)
+}
+
+func hiddenAPISingletonFactory() android.Singleton {
+	return hiddenAPISingleton{}
+}
+
+type hiddenAPISingleton struct{}
+
+// hiddenAPI singleton rules
+func (hiddenAPISingleton) GenerateBuildActions(ctx android.SingletonContext) {
+	// Don't run any hiddenapi rules if UNSAFE_DISABLE_HIDDENAPI_FLAGS=true
+	if ctx.Config().IsEnvTrue("UNSAFE_DISABLE_HIDDENAPI_FLAGS") {
+		return
+	}
+
+	stubFlagsRule(ctx)
+
+	// These rules depend on files located in frameworks/base, skip them if running in a tree that doesn't have them.
+	if ctx.Config().FrameworksBaseDirExists(ctx) {
+		flagsRule(ctx)
+		metadataRule(ctx)
+	} else {
+		emptyFlagsRule(ctx)
+	}
+}
+
+// stubFlagsRule creates the rule to build hiddenapi-stub-flags.txt out of dex jars from stub modules and boot image
+// modules.
+func stubFlagsRule(ctx android.SingletonContext) {
+	// Public API stubs
+	publicStubModules := []string{
+		"android_stubs_current",
+		"android.test.base.stubs",
+	}
+
+	// System API stubs
+	systemStubModules := []string{
+		"android_system_stubs_current",
+	}
+
+	// Test API stubs
+	testStubModules := []string{
+		"android_test_stubs_current",
+	}
+
+	// Core Platform API stubs
+	corePlatformStubModules := []string{
+		"core.platform.api.stubs",
+	}
+
+	// Allow products to define their own stubs for custom product jars that apps can use.
+	publicStubModules = append(publicStubModules, ctx.Config().ProductHiddenAPIStubs()...)
+	systemStubModules = append(systemStubModules, ctx.Config().ProductHiddenAPIStubsSystem()...)
+	testStubModules = append(testStubModules, ctx.Config().ProductHiddenAPIStubsTest()...)
+
+	publicStubPaths := make(android.Paths, len(publicStubModules))
+	systemStubPaths := make(android.Paths, len(systemStubModules))
+	testStubPaths := make(android.Paths, len(testStubModules))
+	corePlatformStubPaths := make(android.Paths, len(corePlatformStubModules))
+
+	moduleListToPathList := map[*[]string]android.Paths{
+		&publicStubModules:       publicStubPaths,
+		&systemStubModules:       systemStubPaths,
+		&testStubModules:         testStubPaths,
+		&corePlatformStubModules: corePlatformStubPaths,
+	}
+
+	var bootDexJars android.Paths
+
+	ctx.VisitAllModules(func(module android.Module) {
+		// Collect dex jar paths for the modules listed above.
+		if j, ok := module.(Dependency); ok {
+			name := ctx.ModuleName(module)
+			for moduleList, pathList := range moduleListToPathList {
+				if i := android.IndexList(name, *moduleList); i != -1 {
+					pathList[i] = j.DexJar()
+				}
+			}
+		}
+
+		// Collect dex jar paths for modules that had hiddenapi encode called on them.
+		if h, ok := module.(hiddenAPIIntf); ok {
+			if jar := h.bootDexJar(); jar != nil {
+				bootDexJars = append(bootDexJars, jar)
+			}
+		}
+	})
+
+	var missingDeps []string
+	// Ensure all modules were converted to paths
+	for moduleList, pathList := range moduleListToPathList {
+		for i := range pathList {
+			if pathList[i] == nil {
+				if ctx.Config().AllowMissingDependencies() {
+					missingDeps = append(missingDeps, (*moduleList)[i])
+					pathList[i] = android.PathForOutput(ctx, "missing")
+				} else {
+					ctx.Errorf("failed to find dex jar path for module %q",
+						(*moduleList)[i])
+				}
+			}
+		}
+	}
+
+	// Singleton rule which applies hiddenapi on all boot class path dex files.
+	rule := android.NewRuleBuilder()
+
+	outputPath := hiddenAPISingletonPaths(ctx).stubFlags
+	tempPath := android.PathForOutput(ctx, outputPath.Rel()+".tmp")
+
+	rule.MissingDeps(missingDeps)
+
+	rule.Command().
+		Tool(pctx.HostBinToolPath(ctx, "hiddenapi").String()).
+		Text("list").
+		FlagForEachInput("--boot-dex=", bootDexJars.Strings()).
+		FlagWithInputList("--public-stub-classpath=", publicStubPaths.Strings(), ":").
+		FlagWithInputList("--public-stub-classpath=", systemStubPaths.Strings(), ":").
+		FlagWithInputList("--public-stub-classpath=", testStubPaths.Strings(), ":").
+		FlagWithInputList("--core-platform-stub-classpath=", corePlatformStubPaths.Strings(), ":").
+		FlagWithOutput("--out-api-flags=", tempPath.String())
+
+	commitChangeForRestat(rule, tempPath, outputPath)
+
+	rule.Build(pctx, ctx, "hiddenAPIStubFlagsFile", "hiddenapi stub flags")
+}
+
+// flagsRule creates a rule to build hiddenapi-flags.csv out of flags.csv files generated for boot image modules and
+// the greylists.
+func flagsRule(ctx android.SingletonContext) {
+	var flagsCSV android.Paths
+
+	var greylistIgnoreConflicts android.Path
+
+	ctx.VisitAllModules(func(module android.Module) {
+		if h, ok := module.(hiddenAPIIntf); ok {
+			if csv := h.flagsCSV(); csv != nil {
+				flagsCSV = append(flagsCSV, csv)
+			}
+		} else if ds, ok := module.(*Droidstubs); ok && ctx.ModuleName(module) == "hiddenapi-lists-docs" {
+			greylistIgnoreConflicts = ds.removedDexApiFile
+		}
+	})
+
+	if greylistIgnoreConflicts == nil {
+		ctx.Errorf("failed to find removed_dex_api_filename from hiddenapi-lists-docs module")
+		return
+	}
+
+	rule := android.NewRuleBuilder()
+
+	outputPath := hiddenAPISingletonPaths(ctx).flags
+	tempPath := android.PathForOutput(ctx, outputPath.Rel()+".tmp")
+
+	stubFlags := hiddenAPISingletonPaths(ctx).stubFlags
+
+	rule.Command().
+		Tool(android.PathForSource(ctx, "frameworks/base/tools/hiddenapi/generate_hiddenapi_lists.py").String()).
+		FlagWithInput("--csv ", stubFlags.String()).
+		Inputs(flagsCSV.Strings()).
+		FlagWithInput("--greylist ",
+			android.PathForSource(ctx, "frameworks/base/config/hiddenapi-greylist.txt").String()).
+		FlagWithInput("--greylist-ignore-conflicts ",
+			greylistIgnoreConflicts.String()).
+		FlagWithInput("--greylist-max-p ",
+			android.PathForSource(ctx, "frameworks/base/config/hiddenapi-greylist-max-p.txt").String()).
+		FlagWithInput("--greylist-max-o-ignore-conflicts ",
+			android.PathForSource(ctx, "frameworks/base/config/hiddenapi-greylist-max-o.txt").String()).
+		FlagWithInput("--blacklist ",
+			android.PathForSource(ctx, "frameworks/base/config/hiddenapi-force-blacklist.txt").String()).
+		FlagWithOutput("--output ", tempPath.String())
+
+	commitChangeForRestat(rule, tempPath, outputPath)
+
+	rule.Build(pctx, ctx, "hiddenAPIFlagsFile", "hiddenapi flags")
+}
+
+// emptyFlagsRule creates a rule to build an empty hiddenapi-flags.csv, which is needed by master-art-host builds that
+// have a partial manifest without frameworks/base but still need to build a boot image.
+func emptyFlagsRule(ctx android.SingletonContext) {
+	rule := android.NewRuleBuilder()
+
+	outputPath := hiddenAPISingletonPaths(ctx).flags
+
+	rule.Command().Text("rm").Flag("-f").Output(outputPath.String())
+	rule.Command().Text("touch").Output(outputPath.String())
+
+	rule.Build(pctx, ctx, "emptyHiddenAPIFlagsFile", "empty hiddenapi flags")
+}
+
+// metadataRule creates a rule to build hiddenapi-greylist.csv out of the metadata.csv files generated for boot image
+// modules.
+func metadataRule(ctx android.SingletonContext) {
+	var metadataCSV android.Paths
+
+	ctx.VisitAllModules(func(module android.Module) {
+		if h, ok := module.(hiddenAPIIntf); ok {
+			if csv := h.metadataCSV(); csv != nil {
+				metadataCSV = append(metadataCSV, csv)
+			}
+		}
+	})
+
+	rule := android.NewRuleBuilder()
+
+	outputPath := hiddenAPISingletonPaths(ctx).metadata
+
+	rule.Command().
+		Tool(android.PathForSource(ctx, "frameworks/base/tools/hiddenapi/merge_csv.py").String()).
+		Inputs(metadataCSV.Strings()).
+		Text(">").
+		Output(outputPath.String())
+
+	rule.Build(pctx, ctx, "hiddenAPIGreylistMetadataFile", "hiddenapi greylist metadata")
+}
+
+// commitChangeForRestat adds a command to a rule that updates outputPath from tempPath if they are different.  It
+// also marks the rule as restat and marks the tempPath as a temporary file that should not be considered an output of
+// the rule.
+func commitChangeForRestat(rule *android.RuleBuilder, tempPath, outputPath android.WritablePath) {
+	rule.Restat()
+	rule.Temporary(tempPath.String())
+	rule.Command().
+		Text("(").
+		Text("if").
+		Text("cmp -s").Input(tempPath.String()).Output(outputPath.String()).Text(";").
+		Text("then").
+		Text("rm").Input(tempPath.String()).Text(";").
+		Text("else").
+		Text("mv").Input(tempPath.String()).Output(outputPath.String()).Text(";").
+		Text("fi").
+		Text(")")
+}
+
+func init() {
+	android.RegisterMakeVarsProvider(pctx, hiddenAPIMakeVars)
+}
+
+// Export paths to Make.  INTERNAL_PLATFORM_HIDDENAPI_FLAGS is used by Make rules in art/ and cts/.
+// Both paths are used to call dist-for-goals.
+func hiddenAPIMakeVars(ctx android.MakeVarsContext) {
+	if !ctx.Config().IsEnvTrue("UNSAFE_DISABLE_HIDDENAPI_FLAGS") {
+		singletonPaths := ctx.Config().Get(hiddenAPISingletonPathsKey).(hiddenAPISingletonPathsStruct)
+		ctx.Strict("INTERNAL_PLATFORM_HIDDENAPI_FLAGS", singletonPaths.flags.String())
+		ctx.Strict("INTERNAL_PLATFORM_HIDDENAPI_GREYLIST_METADATA", singletonPaths.metadata.String())
+	}
+}
diff --git a/java/java.go b/java/java.go
index d51420c..22829e4 100644
--- a/java/java.go
+++ b/java/java.go
@@ -313,6 +313,7 @@
 	// expanded Jarjar_rules
 	expandJarjarRules android.Path
 
+	hiddenAPI
 	dexpreopter
 }
 
@@ -331,6 +332,7 @@
 	ImplementationJars() android.Paths
 	ResourceJars() android.Paths
 	ImplementationAndResourcesJars() android.Paths
+	DexJar() android.Path
 	AidlIncludeDirs() android.Paths
 	ExportedSdkLibs() []string
 }
@@ -1216,18 +1218,8 @@
 		}
 
 		// Hidden API CSV generation and dex encoding
-		if !ctx.Config().IsEnvTrue("UNSAFE_DISABLE_HIDDENAPI_FLAGS") {
-			isBootJar := inList(ctx.ModuleName(), ctx.Config().BootJars())
-			if isBootJar || inList(ctx.ModuleName(), ctx.Config().HiddenAPIExtraAppUsageJars()) {
-				// Derive the greylist from classes jar.
-				hiddenAPIGenerateCSV(ctx, j.implementationJarFile)
-			}
-			if isBootJar {
-				hiddenAPIJar := android.PathForModuleOut(ctx, "hiddenapi", jarName)
-				hiddenAPIEncodeDex(ctx, hiddenAPIJar, dexOutputFile, j.deviceProperties.UncompressDex)
-				dexOutputFile = hiddenAPIJar
-			}
-		}
+		dexOutputFile = j.hiddenAPI.hiddenAPI(ctx, dexOutputFile, j.implementationJarFile,
+			j.deviceProperties.UncompressDex)
 
 		// merge dex jar with resources if necessary
 		if j.resourceJar != nil {
@@ -1365,6 +1357,10 @@
 	return android.Paths{j.implementationJarFile}
 }
 
+func (j *Module) DexJar() android.Path {
+	return j.dexJarFile
+}
+
 func (j *Module) ResourceJars() android.Paths {
 	if j.resourceJar == nil {
 		return nil
@@ -1775,6 +1771,10 @@
 	return android.Paths{j.combinedClasspathFile}
 }
 
+func (j *Import) DexJar() android.Path {
+	return nil
+}
+
 func (j *Import) AidlIncludeDirs() android.Paths {
 	return nil
 }