developerpact 0.1.1

Closed-testing engagement reporter for developerpact.com. Reports a random install id and daily foreground seconds for testers paired through the platform; ordinary users generate no traffic. Android only.

0.1.1

• Point repository and issue_tracker at the public source repository, so the links on the pub.dev page open for everyone. No code change: the Dart and Java sources are byte for byte those of 0.1.0.

0.1.0

Initial release. Wire protocol frozen at v: 1 (https://developerpact.com/sdk/api).

• DeveloperPact.start() / DeveloperPact.isSupported; nothing else is public.
• Android native core in Java: Install Referrer pairing, devpact:// deep-link pairing (PairActivity), started-activity foreground counter with 20 s checkpoints, per-local-day buckets (session cap 4 h, day cap 8 h, 7 days retained), daily heartbeat with cumulative seconds, installer check, kill switch on 410 {stop:true}.
• Every documented server answer has a fixed local effect (Protocol.pairAction / heartbeatAction, JUnit-covered): 410 {stop:false, reason:"token_expired"} leaves the install unpaired for a fresh token, 404 on a heartbeat forgets the pairing, 401 changes nothing, and 422 "day out of window" drops that day's bucket and re-syncs the local day from serverDay (a whole-day clock correction kept in prefs until the server agrees with the raw clock again).
• pair sends tzOffsetMin so the pairing day is named in the tester's own calendar; appVersionCode is clamped to the signed 32-bit range the server accepts.
• Only dependency: com.android.installreferrer:installreferrer:2.2.
• Merged permissions: android.permission.INTERNET, com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE.
• Dart stub on iOS, macOS, web, Windows, Linux: returns unsupported, never throws.
• tool/trust.sh prints the trust manifest (line counts, reproducible archive SHA-256, merged permissions of the example build) that developerpact.com/sdk shows; tool/check-merged-manifest.sh enforces the permission allowlist.