Skip to Content
ReferenceDistribution Model

Distribution Model

PlatformIntended channelSource visibility
Webnpm (onesygnal-web-sdk) + CDN bundlePublic (npm package is source-visible)
iOSCocoaPods + Swift Package Manager, binary (XCFramework)Closed — binary only
AndroidMaven Central, binary (AAR)Closed — binary only
Flutterpub.dev (onesygnal)Public — pub.dev requires package source

Why the natives are closed-source

Per ADR 0006 , the native SDKs live in this private monorepo and are meant to distribute as binaries only — an AAR on Maven Central, an XCFramework via an SPM binary target and a CocoaPods podspec. The Flutter bridge is the one publicly-visible source artifact, which is acceptable because — per ADR 0004 — the bridge contains no triggering/rendering pipeline logic, just method-channel plumbing. Keeping the natives closed protects that pipeline as the commercial core, at the cost of binary-only debugging for integrators.

Current reality doesn’t match the intent yet — flagged, not hidden

Nothing has been published yet, and what exists today has real gaps against the ADR 0006 target:

  • apps/ios-sdk/OneSygnalSDK.podspec ships source_files (i.e., source, not a binary XCFramework target) — the opposite of the intended distribution shape. Its :git field points at a repository that does not exist. scripts/build-xcframework.sh exists but has no CI caller.
  • Android resolves a fixed Maven coordinate from mavenLocal() (io.onesygnal:android-sdk:0.1.0), not a real Maven Central artifact. Gradle’s dependency/transform caching doesn’t reliably invalidate for a fixed-version mavenLocal() artifact whose content changed without its coordinate changing — CI is safe because it runs publishToMavenLocal explicitly before each build; local dev isn’t.
  • iOS vendors source into the Flutter bridge via a prepare_command copy, not a versioned dependency — a cp -R at pod-install time with no version and no checksum. The copy can silently drift from apps/ios-sdk/Sources/OneSygnal; Podfile.lock’s checksum covers only the podspec text, not the copied tree.

This page documents the ADR’s intent — treat the CocoaPods/SPM/Maven Central install snippets on each platform’s Install page as the target shape, not a claim that they work against a real published package today. The podspec/Maven gaps above are open follow-ups, not settled.

See SDK Versions for the related version-tracking gaps.

SDK Versions