feat!: harden iOS and Android SDKs for 1.0.0

[gcg]

Final pre-1.0 pass over both native SDKs. It locks the public API to what we intend to support, fixes host-app crash and privacy risks, and makes CI actually compile the iOS UI layer.

⚠️ Breaking changes (why this should be the major release)

• iOS public API reduced to PoltioSDK, PoltioLogLevel and PoltioPurchaseItem. PoltioOverlayManager, PoltioWebViewController, PoltioPassthroughWindow, the trigger views, PoltioWidgetResponse/PoltioOverlayOptions, CachedWidgetResult, PoltioLogger and AnyCodable are now internal. AnyCodable was renamed to PoltioAnyCodable so it can't clash with the popular AnyCodable package. The new PoltioSDK.hideTrigger() replaces PoltioOverlayManager.shared.hideTrigger(). The instance-level cacheTTL/cacheLimit/clearCache() are internal; use the static ones.
• Android public API reduced: PoltioLogger, PoltioWidgetResponse, PoltioOverlayOptions and PoltioWebViewActivity are internal.
• Android PoltioSDK.onWidgetEvent is now a PoltioWidgetEventListener fun interface instead of a Kotlin function type: PoltioSDK.onWidgetEvent = PoltioWidgetEventListener { event, data -> }.
• The default log level is warning on both platforms (was info).

Changes

1. API surface: see above.
2. Java interop (Android): @JvmStatic on every PoltioSDK member, and @JvmOverloads on configure/track/recordPurchase/PoltioPurchaseItem. A Java test (PoltioSDKJavaInteropTest) compiles against the API the way a Java host would.
3. Android renderer crash: onRenderProcessGone now closes the sheet instead of letting Android kill the host process.
4. iOS WebView navigation policy, matching Android. Only *.poltio.com loads in the sheet. External links, target="_blank"/window.open, tel:/mailto: and deep links go to the system. The sheet reloads if the web content process is terminated. Both platforms share a tested isTrustedWidgetURL check.
5. iOS privacy manifest: declares UserDefaults (CA92.1) and the collected data types (Device ID, User ID, Purchase History, Product Interaction), all with tracking = false. Documented in docs/IOS.md. Please sanity-check the linked/purpose choices against our privacy policy.
6. CI and Makefile:
   • make test-ios now runs on an iOS Simulator. Previously, swift test on macOS compiled out the whole UIKit layer: 58 tests instead of 46 run now, 62 with the new ones.
   • make build-ios also builds for the simulator SDK.
   • New make test-ios-macos keeps the quick host-only run.
   • New lint-pod CI job (pod lib lint). The podspec moved to the repo root so local lint can resolve paths; the publish workflow and bump script are updated.
7. Repo hygiene: untracked ~94 MB / ~2,200 committed example/ios/.build + .swiftpm files. They're already gitignored. History is not rewritten.
8. Android main-thread I/O: configure/track/identify/recordPurchase do no disk I/O on the caller's thread. Work runs on a serial background executor, so view events keep their call order.
9. Logging: iOS uses os_log (subsystem com.poltio.sdk) instead of print. PUID, sdk_id and event params are only logged at debug.
10. SDK version headers: every request sends X-Poltio-SDK-Version and X-Poltio-SDK-Platform, and PoltioSDK.version is public. Android takes the version from the published Maven version; iOS reads PoltioSDKInfo.version, which make version now bumps.
11. track() docs: non-view events are documented as local-only. The iOS example's "TrackConversion" button now calls recordPurchase.
12. Android sheet insets: the sheet is edge-to-edge and applies the navigation-bar and keyboard (IME) insets, so lead-form inputs stay above the keyboard.
13. Accessibility: triggers expose a button role, a label built from their visible text, and close/collapse custom actions on iOS. With VoiceOver or TalkBack on, activating a collapsed trigger opens the widget directly.
14. Android activity tracking: if configure() is called late with an Activity, that Activity is used for triggers right away. Dismissals are persisted against the application context.

Small fixes: iOS force unwraps in recordPurchase removed; view request-ID race fixed on both platforms; consumer R8 rule keeps @JavascriptInterface methods.

Not in this PR

• The "Close" and fallback accessibility strings are still English-only (not localized).
• No in-memory icon cache and no Reduce Motion handling for the pulse animation.
• iOS still uses the deprecated UIApplication.shared.windows/keyWindow fallbacks.

Release notes

• iOS version constant: for future releases, run make version VERSION=x.y.z before merging. SPM consumers build from the tagged source, so PoltioSDKInfo.version must already be correct at tag time. It's set to 1.0.0 here.
• Backend: check that the API accepts the two new request headers (they're plain custom headers).

Testing

• make test-ios: 62/62 on an iOS Simulator
• make test-ios-macos: passes
• make test-android: 81/81 (debug + release)
• make lint-ios, make lint-android, make lint-pod, make lint-actions: all clean
• make build-ios, make build-android, make build-example-ios, make build-example-android: all succeed
• Not yet checked on a device: the Android keyboard insets with a real lead form, TalkBack/VoiceOver behaviour, and iOS external-link handoff.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces major enhancements to the Poltio Mobile SDK, including robust Java interop support, off-main-thread execution of disk and network operations via a new serial executor, TalkBack accessibility configurations for floating triggers, and WebView stability improvements such as edge-to-edge layouts and renderer crash handling. The code review highlights a security vulnerability where blob: and data: schemes bypass trusted URL checks, a consistency issue in PoltioFloatingBoxTriggerView when handling clicks in accessibility mode, and a bug where user identifiers (PUID) set prior to SDK configuration fail to persist to disk.

[gcg]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the Poltio Mobile SDK to version 1.0.0, introducing improved background thread execution for disk I/O, enhanced Java interop, TalkBack accessibility support for floating triggers, and edge-to-edge layout handling in the WebView activity. Feedback identifies a critical security vulnerability in the trusted URL validation logic where a parser differential between android.net.Uri and Chromium could allow host validation bypass. Additionally, it is recommended to explicitly enable buildConfig in the Gradle build features to prevent compilation failures under newer Android Gradle Plugin versions.

[gcg]

/gemini review

[gemini-code-assist]

Code Review

This pull request refactors the Poltio Android SDK to improve Java interoperability, offload disk and network operations to a background serial executor, and enhance the WebView activity with edge-to-edge layout, robust URL validation, and renderer crash handling. It also introduces accessibility support for floating triggers. The review feedback highlights a potential race condition with concurrent requests, recommends unwrapping wrapped contexts to properly resolve activities, suggests using the application context to prevent memory leaks, and points out a missing import for the Build class.

[gcg]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces significant updates to the Poltio Mobile SDK, focusing on Java interop, background thread safety, accessibility, and security. Key changes include preloading identifiers on a background thread, adding JvmStatic and JvmOverloads annotations, introducing TalkBack support for floating triggers, and hardening the WebView with trusted URL validation and crash handling. Feedback on these changes highlights two main areas for improvement: using locale-invariant case conversion (Locale.ROOT) when validating trusted widget URLs to prevent locale-specific bugs, and preserving existing left, top, and right padding values when setting the bottom padding on the sheet view.

[gcg]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces significant updates to the Poltio Mobile SDK, focusing on Java interoperability, background thread offloading for state persistence, edge-to-edge layout support, and accessibility improvements for floating triggers. Key changes include refactoring the Android SDK to use a serial background executor, adding ProGuard rules, implementing robust WebView crash handling, and introducing domain validation for trusted widget URLs. Feedback on these changes highlights a potential issue with weak reference checks when seeding the current activity, a security vulnerability from allowing unencrypted HTTP schemes in trusted URLs, and a missing callback notification to the host app when the WebView renderer process crashes.