@tileflow/react-native 0.0.0-bootstrap.0 → 0.1.0-alpha.0

package/ios/TFAdmissionNetwork.mm

@@ -0,0 +1,268 @@
+#import "TFAdmissionNetwork.h"
+#import "TFDocumentBounds.h"
+#import <mach/mach_time.h>
+#import <atomic>
+
+@interface TFScheduledAdmission : NSObject <TFAdmissionCancel>
+@property (nonatomic, copy, nullable) dispatch_block_t action;
+@property (nonatomic, strong, nullable) dispatch_source_t timer;
+@end
+@implementation TFScheduledAdmission
+- (void)cancel {
+	@synchronized(self) {
+		self.action = nil;
+		if (self.timer) dispatch_source_cancel(self.timer);
+		self.timer = nil;
+	}
+}
+- (void)fire {
+	dispatch_block_t action;
+	@synchronized(self) { action = self.action; [self cancel]; }
+	if (action) action();
+}
+- (void)dealloc { if (_timer) dispatch_source_cancel(_timer); }
+@end
+
+@implementation TFContinuousAdmissionScheduler
+- (NSTimeInterval)nowMs {
+	static mach_timebase_info_data_t timebase;
+	static dispatch_once_t once;
+	dispatch_once(&once, ^{ mach_timebase_info(&timebase); });
+	return (double)mach_continuous_time() * (double)timebase.numer / (double)timebase.denom / 1000000.0;
+}
+- (void)enqueue:(dispatch_block_t)block { dispatch_async(dispatch_get_main_queue(), block); }
+- (id<TFAdmissionCancel>)after:(NSTimeInterval)milliseconds perform:(dispatch_block_t)block {
+	TFScheduledAdmission *token = [TFScheduledAdmission new];
+	token.action = block;
+	dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, dispatch_get_main_queue());
+	token.timer = timer;
+	__weak TFScheduledAdmission *weakToken = token;
+	// Cancellation releases captured work without waiting for the timer date.
+	dispatch_source_set_event_handler(timer, ^{ [weakToken fire]; });
+	dispatch_source_set_timer(timer, dispatch_time(DISPATCH_TIME_NOW, (int64_t)(milliseconds * NSEC_PER_MSEC)), DISPATCH_TIME_FOREVER, 0);
+	dispatch_resume(timer);
+	return token;
+}
+@end
+
+@interface TFAdmissionSessionOperation : NSObject <TFAdmissionCancel, NSURLSessionDataDelegate, NSURLSessionTaskDelegate> {
+	std::atomic_bool _cancelled;
+	std::atomic_bool _finished;
+	std::atomic_bool _started;
+	std::atomic_bool _cleaned;
+}
+@property (nonatomic, strong, nullable) NSURLRequest *request;
+@property (nonatomic, strong, nullable) NSURLSessionConfiguration *configuration;
+@property (nonatomic, strong) NSOperationQueue *delegateQueue;
+@property (nonatomic) BOOL followsRedirects;
+@property (nonatomic) NSUInteger responseByteLimit;
+@property (atomic, copy, nullable) TFAdmissionStartGuard guard;
+@property (nonatomic, copy, nullable) TFAdmissionNetworkCompletion completion;
+@property (nonatomic, copy, nullable) dispatch_block_t cleanup;
+@property (atomic, strong, nullable) NSURLSession *session;
+@property (atomic, strong, nullable) NSURLSessionDataTask *task;
+@property (nonatomic, strong, nullable) NSMutableData *body;
+@property (nonatomic, strong, nullable) NSHTTPURLResponse *response;
+- (BOOL)isCancelled;
+- (void)start;
+- (void)finish:(nullable NSHTTPURLResponse *)response body:(nullable NSData *)body;
+- (void)releaseNativeResources;
+@end
+
+@implementation TFAdmissionSessionOperation
+- (instancetype)init {
+	if ((self = [super init])) {
+		_cancelled.store(false); _finished.store(false); _started.store(false); _cleaned.store(false);
+		_body = [NSMutableData data];
+	}
+	return self;
+}
+- (NSString *)description { return @"TFAdmissionSessionOperation(redacted)"; }
+- (BOOL)isCancelled { return _cancelled.load(); }
+- (BOOL)mayStart {
+	TFAdmissionStartGuard guard = self.guard;
+	return guard && !_cancelled.load() && !_finished.load() && guard();
+}
+- (void)start {
+	if (_started.exchange(true)) return;
+	BOOL noSession = NO;
+	@try {
+		// Protect task construction against native cancellation, not against
+		// JavaScript. There is no asynchronous wait or I/O under this lock.
+		@synchronized(self) {
+			if ([self mayStart]) {
+				NSURLSessionConfiguration *configuration = [self.configuration copy];
+				configuration.waitsForConnectivity = NO;
+				configuration.discretionary = NO;
+				configuration.timeoutIntervalForResource = MIN(30.0, self.request.timeoutInterval);
+				configuration.timeoutIntervalForRequest = MIN(30.0, self.request.timeoutInterval);
+				self.session = [NSURLSession sessionWithConfiguration:configuration delegate:self delegateQueue:self.delegateQueue];
+				self.task = [self.session dataTaskWithRequest:self.request];
+				// Recheck after task creation, immediately before native resume.
+				if (self.task && [self mayStart]) [self.task resume];
+				else [self cancel];
+			} else [self finish:nil body:nil];
+			noSession = self.session == nil;
+		}
+	} @catch (NSException *exception) {
+		[self cancel];
+		@synchronized(self) { noSession = self.session == nil; }
+	}
+	// A request cancelled before queue drain has no native terminal event.
+	// Only processing its queued start may release that reservation.
+	if (noSession) [self releaseNativeResources];
+}
+- (void)cancel {
+	_cancelled.store(true);
+	[self finish:nil body:nil];
+	NSURLSession *session;
+	NSURLSessionDataTask *task;
+	@synchronized(self) { session = self.session; task = self.task; }
+	[task cancel]; [session invalidateAndCancel];
+}
+- (void)finish:(NSHTTPURLResponse *)response body:(NSData *)body {
+	if (_finished.exchange(true)) return;
+	NSURLSession *session;
+	@synchronized(self) { session = self.session; }
+	[session invalidateAndCancel];
+	TFAdmissionNetworkCompletion completion = self.completion;
+	self.completion = nil;
+	if (completion) completion(response, body);
+	// Logical completion is not physical cleanup. A cancelled URLSession
+	// retains its native capacity slot until didBecomeInvalidWithError.
+}
+- (void)releaseNativeResources {
+	if (_cleaned.exchange(true)) return;
+	dispatch_block_t cleanup;
+	@synchronized(self) {
+		self.task = nil; self.session = nil;
+		self.request = nil; self.configuration = nil; self.guard = nil;
+		self.body = nil; self.response = nil;
+		cleanup = self.cleanup; self.cleanup = nil;
+	}
+	if (cleanup) cleanup();
+}
+- (void)URLSession:(NSURLSession *)session didBecomeInvalidWithError:(NSError *)error {
+	[self finish:nil body:nil];
+	[self releaseNativeResources];
+}
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveResponse:(NSURLResponse *)response completionHandler:(void (^)(NSURLSessionResponseDisposition))completionHandler {
+	if (![self mayStart] || ![response isKindOfClass:NSHTTPURLResponse.class] || response.expectedContentLength > (int64_t)self.responseByteLimit) {
+		completionHandler(NSURLSessionResponseCancel); [self cancel]; return;
+	}
+	self.response = (NSHTTPURLResponse *)response;
+	completionHandler(NSURLSessionResponseAllow);
+}
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data {
+	if (![self mayStart] || data.length > self.responseByteLimit - self.body.length) { [self cancel]; return; }
+	[self.body appendData:data];
+}
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error {
+	if (error || ![self mayStart]) [self finish:nil body:nil];
+	else [self finish:self.response body:[self.body copy]];
+}
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task willPerformHTTPRedirection:(NSHTTPURLResponse *)response newRequest:(NSURLRequest *)request completionHandler:(void (^)(NSURLRequest *_Nullable))completionHandler {
+	if (![self mayStart]) { completionHandler(nil); [self cancel]; return; }
+	if (self.followsRedirects) { completionHandler(request); return; }
+	// Observe the response here, not through MapLibre delegate forwarding.
+	completionHandler(nil);
+	[self finish:response body:[NSData data]];
+}
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task willBeginDelayedRequest:(NSURLRequest *)request completionHandler:(void (^)(NSURLSessionDelayedRequestDisposition, NSURLRequest *_Nullable))completionHandler {
+	completionHandler([self mayStart] ? NSURLSessionDelayedRequestContinueLoading : NSURLSessionDelayedRequestCancel, nil);
+}
+- (void)URLSession:(NSURLSession *)session taskIsWaitingForConnectivity:(NSURLSessionTask *)task { [self cancel]; }
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *_Nullable))completionHandler {
+	completionHandler([self mayStart] ? NSURLSessionAuthChallengePerformDefaultHandling : NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
+}
+- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *_Nullable))completionHandler {
+	completionHandler([self mayStart] ? NSURLSessionAuthChallengePerformDefaultHandling : NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
+}
+@end
+
+@interface TFAdmissionURLSessionNetwork ()
+@property (nonatomic, strong) NSURLSessionConfiguration *configuration;
+@property (nonatomic) BOOL followsRedirects;
+@property (nonatomic) NSUInteger responseByteLimit;
+@property (nonatomic) NSUInteger queueDepth;
+@property (nonatomic) NSUInteger concurrency;
+@property (nonatomic) NSUInteger reservations;
+@property (nonatomic, strong) dispatch_queue_t queue;
+@property (nonatomic, strong) NSOperationQueue *delegateQueue;
+@property (nonatomic, strong) NSMutableArray<TFAdmissionSessionOperation *> *pending;
+@property (nonatomic, strong) NSMutableSet<TFAdmissionSessionOperation *> *active;
+@property (atomic) BOOL closed;
+@end
+
+@implementation TFAdmissionURLSessionNetwork
+- (instancetype)initWithConfiguration:(NSURLSessionConfiguration *)configuration followsRedirects:(BOOL)followsRedirects {
+	return [self initWithConfiguration:configuration followsRedirects:followsRedirects responseByteLimit:8388608 queueDepth:2048 concurrency:16];
+}
+- (instancetype)initWithConfiguration:(NSURLSessionConfiguration *)configuration followsRedirects:(BOOL)followsRedirects responseByteLimit:(NSUInteger)responseByteLimit queueDepth:(NSUInteger)queueDepth concurrency:(NSUInteger)concurrency {
+	return [self initWithConfiguration:configuration followsRedirects:followsRedirects responseByteLimit:responseByteLimit queueDepth:queueDepth concurrency:concurrency
+		workQueue:dispatch_queue_create("dev.tileflow.native-admission.network", DISPATCH_QUEUE_SERIAL)];
+}
+- (instancetype)initWithConfiguration:(NSURLSessionConfiguration *)configuration followsRedirects:(BOOL)followsRedirects responseByteLimit:(NSUInteger)responseByteLimit queueDepth:(NSUInteger)queueDepth concurrency:(NSUInteger)concurrency workQueue:(dispatch_queue_t)workQueue {
+	if ((self = [super init])) {
+		if (!workQueue || !responseByteLimit || responseByteLimit > 8388608 || !queueDepth || queueDepth > 2048 || !concurrency || concurrency > 16 || concurrency > queueDepth) {
+			[NSException raise:@"TFNativeAdmissionBounds" format:@"Invalid native transport bounds"];
+		}
+		_configuration = [configuration copy]; _followsRedirects = followsRedirects;
+		_responseByteLimit = responseByteLimit; _queueDepth = queueDepth; _concurrency = concurrency;
+		_queue = workQueue;
+		_delegateQueue = [NSOperationQueue new]; _delegateQueue.maxConcurrentOperationCount = 1;
+		_pending = [NSMutableArray array]; _active = [NSMutableSet set];
+	}
+	return self;
+}
+- (NSString *)description { return @"TFAdmissionURLSessionNetwork(redacted)"; }
+- (id<TFAdmissionCancel>)start:(NSURLRequest *)request mayStart:(TFAdmissionStartGuard)guard completion:(TFAdmissionNetworkCompletion)completion {
+	NSUInteger responseByteLimit = TFDocumentResponseByteLimit(request, self.responseByteLimit);
+	BOOL reserved;
+	@synchronized(self) {
+		reserved = !self.closed && self.reservations < self.queueDepth;
+		if (reserved) self.reservations++;
+	}
+	TFAdmissionSessionOperation *operation = [TFAdmissionSessionOperation new];
+	operation.request = [request copy]; operation.guard = guard; operation.configuration = self.configuration;
+	operation.delegateQueue = self.delegateQueue; operation.followsRedirects = self.followsRedirects;
+	operation.responseByteLimit = responseByteLimit;
+	operation.completion = completion;
+	__weak TFAdmissionSessionOperation *weakOperation = operation;
+	operation.cleanup = ^{
+		if (reserved) dispatch_async(self.queue, ^{
+			TFAdmissionSessionOperation *finished = weakOperation;
+			if (finished) { [self.active removeObject:finished]; [self.pending removeObject:finished]; }
+			@synchronized(self) { self.reservations--; }
+			[self drain];
+		});
+	};
+	if (!reserved) { [operation cancel]; [operation start]; return operation; }
+	// Capacity is reserved before posting. Native terminal cleanup, not
+	// promise rejection, releases it after a URLSession has been created.
+	dispatch_async(self.queue, ^{
+		if (self.closed || operation.isCancelled) { [operation cancel]; [operation start]; return; }
+		[self.pending addObject:operation];
+		[self drain];
+	});
+	return operation;
+}
+- (void)drain {
+	while (!self.closed && self.active.count < self.concurrency && self.pending.count) {
+		TFAdmissionSessionOperation *operation = self.pending.firstObject;
+		[self.pending removeObjectAtIndex:0];
+		if (operation.isCancelled) { [operation start]; continue; }
+		[self.active addObject:operation];
+		[operation start];
+	}
+}
+- (void)close {
+	@synchronized(self) { if (self.closed) return; self.closed = YES; }
+	dispatch_async(self.queue, ^{
+		for (TFAdmissionSessionOperation *operation in [self.pending copy]) { [operation cancel]; [operation start]; }
+		[self.pending removeAllObjects];
+		// Keep active sessions and their reservations until invalidation.
+		for (TFAdmissionSessionOperation *operation in [self.active copy]) [operation cancel];
+	});
+}
+@end

package/ios/TFAdmissionURL.mm

@@ -0,0 +1,116 @@
+#import "TFAdmissionEngine.h"
+#import "TFNativeDocumentURL.h"
+
+NSString *const TFAdmissionGrantHeader = @"X-Tileflow-Native-Grant";
+
+static void TFInvalidURL(void) {
+	@throw [NSException exceptionWithName:@"TFNativeAdmissionInvalid" reason:@"Invalid native resource" userInfo:nil];
+}
+static BOOL TFMatches(NSString *value, NSString *pattern) {
+	if (![value isKindOfClass:NSString.class]) return NO;
+	NSRegularExpression *expression = [NSRegularExpression regularExpressionWithPattern:pattern options:0 error:nil];
+	return [expression numberOfMatchesInString:value options:0 range:NSMakeRange(0, value.length)] == 1;
+}
+static NSString *TFDecodeKey(NSString *value) {
+	NSMutableString *decoded = [NSMutableString string];
+	for (NSUInteger index = 0; index < value.length; index++) {
+		unichar character = [value characterAtIndex:index];
+		if (character == '%' && index + 2 < value.length) {
+			NSString *hex = [value substringWithRange:NSMakeRange(index + 1, 2)];
+			if (TFMatches(hex, @"^[0-9a-fA-F]{2}$")) {
+				unsigned int byte = 0;
+				[[NSScanner scannerWithString:hex] scanHexInt:&byte];
+				[decoded appendFormat:@"%C", (unichar)byte];
+				index += 2;
+				continue;
+			}
+		}
+		[decoded appendFormat:@"%C", character];
+	}
+	return decoded;
+}
+BOOL TFAdmissionValidToken(id value) {
+	return [value isKindOfClass:NSString.class] && TFMatches(value, @"^[A-Za-z0-9_.-]{1,96}$") && ![value hasPrefix:@"tf_"];
+}
+BOOL TFAdmissionHasReservedContext(NSString *url) {
+	if (![url isKindOfClass:NSString.class]) return NO;
+	NSRange query = [url rangeOfString:@"?"];
+	if (query.location == NSNotFound) return NO;
+	for (NSString *part in [[url substringFromIndex:query.location + 1] componentsSeparatedByString:@"&"]) {
+		NSString *key = [part componentsSeparatedByString:@"="].firstObject;
+		if ([TFDecodeKey(key).lowercaseString hasPrefix:@"__tf_native"]) return YES;
+	}
+	return NO;
+}
+static NSString *TFURLOrigin(NSString *url, BOOL permitsHTTP) {
+	NSURLComponents *components = [NSURLComponents componentsWithString:url];
+	if ((![[components scheme] isEqual:@"https"] && !(permitsHTTP && [components.scheme isEqual:@"http"])) || !components.host.length || components.user != nil || components.password != nil) TFInvalidURL();
+	NSString *host = components.host.lowercaseString;
+	if ([host containsString:@":"] && ![host hasPrefix:@"["]) host = [NSString stringWithFormat:@"[%@]", host];
+	NSNumber *port = components.port;
+	if (port && (port.integerValue < 1 || port.integerValue > 65535)) TFInvalidURL();
+	NSInteger defaultPort = [components.scheme isEqual:@"https"] ? 443 : 80;
+	return [NSString stringWithFormat:@"%@://%@%@", components.scheme, host, port && port.integerValue != defaultPort ? [NSString stringWithFormat:@":%@", port] : @""];
+}
+NSString *TFAdmissionOrigin(NSString *url) { return TFURLOrigin(url, NO); }
+NSString *TFNativeDocumentOrigin(NSString *url) { return TFURLOrigin(url, YES); }
+BOOL TFAdmissionStyleMatchesMap(NSString *url, NSString *mapId) {
+	@try {
+		if (![url isKindOfClass:NSString.class] || url.length > 2048) return NO;
+		NSString *origin = TFAdmissionOrigin(url);
+		if (![url hasPrefix:[origin stringByAppendingString:@"/"]]) return NO;
+		NSString *path = [url substringFromIndex:origin.length];
+		if (!TFMatches(TFDecodeKey(path), @"^/maps/[^/?#]+/native(?:[/?#]|$)")) return YES;
+		NSRegularExpression *pattern = [NSRegularExpression regularExpressionWithPattern:@"^/maps/(map_[A-Za-z0-9_-]{16})/native/v([1-9][0-9]{0,15})/([A-Za-z][A-Za-z0-9_-]{0,63})\\.json$" options:0 error:nil];
+		NSTextCheckingResult *match = [pattern firstMatchInString:path options:0 range:NSMakeRange(0, path.length)];
+		if (!match || ![[path substringWithRange:[match rangeAtIndex:1]] isEqual:mapId]) return NO;
+		long long version = [[path substringWithRange:[match rangeAtIndex:2]] longLongValue];
+		return version > 0 && version <= 9007199254740991LL;
+	} @catch (NSException *exception) { return NO; }
+}
+static NSString *TFCleanURL(NSString *url, NSString *developmentOrigin) {
+	if (![url isKindOfClass:NSString.class] || url.length > 2048 || !TFMatches(url, @"^[\\x21-\\x7e]+$") || [url containsString:@"\\"] || [url containsString:@"#"] || TFAdmissionHasReservedContext(url)) TFInvalidURL();
+	NSURLComponents *components = [NSURLComponents componentsWithString:url];
+	NSString *origin = TFURLOrigin(url, developmentOrigin != nil);
+	if ([components.scheme isEqual:@"http"] && ![origin isEqual:developmentOrigin]) TFInvalidURL();
+	if (![url hasPrefix:[origin stringByAppendingString:@"/"]] || ![components.URL.absoluteString isEqual:url]) TFInvalidURL();
+	for (NSString *segment in [components.percentEncodedPath componentsSeparatedByString:@"/"]) {
+		NSString *decoded = TFDecodeKey(segment);
+		if ([decoded isEqual:@"."] || [decoded isEqual:@".."]) TFInvalidURL();
+	}
+	NSString *decoded = TFDecodeKey(url).lowercaseString;
+	if ([decoded containsString:@"tf_native_"] || [decoded containsString:@"tf_public_"]) TFInvalidURL();
+	return url;
+}
+NSString *TFAdmissionCleanURL(NSString *url) { return TFCleanURL(url, nil); }
+NSString *TFNativeDocumentCleanURL(NSString *url, NSString *developmentOrigin) {
+	if (developmentOrigin) {
+		if (![developmentOrigin isKindOfClass:NSString.class] || ![developmentOrigin hasPrefix:@"http://"]) TFInvalidURL();
+		NSString *root = [developmentOrigin stringByAppendingString:@"/"];
+		if (![TFNativeDocumentOrigin(root) isEqual:developmentOrigin]) TFInvalidURL();
+		TFCleanURL(root, developmentOrigin);
+	}
+	return TFCleanURL(url, developmentOrigin);
+}
+NSDictionary<NSString *, NSString *> *TFAdmissionStripContext(NSString *url) {
+	if (![url isKindOfClass:NSString.class] || url.length > 2048 || [url containsString:@"#"] || [url containsString:@"\\"]) TFInvalidURL();
+	NSRange query = [url rangeOfString:@"?"];
+	if (query.location == NSNotFound) TFInvalidURL();
+	NSArray<NSString *> *parts = [[url substringFromIndex:query.location + 1] componentsSeparatedByString:@"&"];
+	NSMutableArray<NSString *> *remaining = [NSMutableArray array];
+	NSString *context = nil;
+	for (NSString *part in parts) {
+		NSString *key = [part componentsSeparatedByString:@"="].firstObject;
+		if ([TFDecodeKey(key).lowercaseString hasPrefix:@"__tf_native"]) {
+			if (context || ![part hasPrefix:@"__tf_native_context="]) TFInvalidURL();
+			context = [part substringFromIndex:@"__tf_native_context=".length];
+			if (!TFAdmissionValidToken(context)) TFInvalidURL();
+		} else [remaining addObject:part];
+	}
+	if (!context) TFInvalidURL();
+	NSString *clean = [[url substringToIndex:query.location] stringByAppendingString:remaining.count ? [@"?" stringByAppendingString:[remaining componentsJoinedByString:@"&"]] : @""];
+	return @{@"context": context, @"url": TFAdmissionCleanURL(clean)};
+}
+NSError *TFAdmissionSafeError(void) {
+	return [NSError errorWithDomain:@"TileflowNativeAdmission" code:1 userInfo:@{NSLocalizedDescriptionKey: @"Native resource admission failed"}];
+}

package/ios/TFDocumentBounds.h

@@ -0,0 +1,9 @@
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+// Private request metadata, never an HTTP header or URL parameter.
+FOUNDATION_EXPORT void TFDocumentSetByteLimit(NSMutableURLRequest *request, NSUInteger maximumBytes);
+FOUNDATION_EXPORT NSUInteger TFDocumentResponseByteLimit(NSURLRequest *request, NSUInteger transportMaximum);
+
+NS_ASSUME_NONNULL_END

package/ios/TFDocumentBounds.mm

@@ -0,0 +1,19 @@
+#import "TFDocumentBounds.h"
+#import <cmath>
+
+static NSString *const TFDocumentLimitKey = @"dev.tileflow.native.document-byte-limit";
+static void TFInvalidDocumentLimit(void) {
+	@throw [NSException exceptionWithName:@"TFNativeDocumentInvalid" reason:@"Native document acquisition failed." userInfo:nil];
+}
+void TFDocumentSetByteLimit(NSMutableURLRequest *request, NSUInteger maximumBytes) {
+	if (!request || !maximumBytes || maximumBytes > 8388608) TFInvalidDocumentLimit();
+	[NSURLProtocol setProperty:@(maximumBytes) forKey:TFDocumentLimitKey inRequest:request];
+}
+NSUInteger TFDocumentResponseByteLimit(NSURLRequest *request, NSUInteger transportMaximum) {
+	id value = [NSURLProtocol propertyForKey:TFDocumentLimitKey inRequest:request];
+	if (!value) return transportMaximum;
+	if (![value isKindOfClass:NSNumber.class] || CFGetTypeID((__bridge CFTypeRef)value) == CFBooleanGetTypeID() ||
+		!std::isfinite([value doubleValue]) || std::floor([value doubleValue]) != [value doubleValue] ||
+		[value doubleValue] < 1 || [value doubleValue] > 8388608) TFInvalidDocumentLimit();
+	return MIN(transportMaximum, [value unsignedIntegerValue]);
+}

package/ios/TFMobileConfiguration.h

@@ -0,0 +1,23 @@
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+/** Application data only; not a Map, session or transport identity. */
+@interface TFMobileConfiguration : NSObject
+@property(nonatomic, copy, readonly) NSString *apiOrigin;
+@property(nonatomic, copy, readonly) NSString *credential;
+- (instancetype)init NS_UNAVAILABLE;
++ (instancetype)new NS_UNAVAILABLE;
++ (nullable instancetype)parse:(nullable id)values error:(NSError *_Nullable *_Nullable)error;
++ (nullable instancetype)fromInfo:(nullable NSDictionary *)info
+	localized:(nullable NSDictionary *)localized
+	error:(NSError *_Nullable *_Nullable)error;
+@end
+
+/** A synchronized process snapshot. Source providers and React contexts are never retained. */
+@interface TFMobileConfigurationCache : NSObject
+- (nullable TFMobileConfiguration *)read:(TFMobileConfiguration *_Nullable (^)(void))source
+	error:(NSError *_Nullable *_Nullable)error;
+@end
+
+NS_ASSUME_NONNULL_END

package/ios/TFMobileConfiguration.mm

@@ -0,0 +1,139 @@
+#import "TFMobileConfiguration.h"
+
+static NSError *TFMobileConfigurationFailure(void) {
+	return [NSError errorWithDomain:@"TileflowNativeConfiguration" code:1 userInfo:@{
+		NSLocalizedDescriptionKey: @"Native application configuration is invalid."
+	}];
+}
+
+static BOOL TFMobileMatches(NSString *value, NSString *pattern) {
+	NSRegularExpression *expression = [NSRegularExpression regularExpressionWithPattern:pattern options:0 error:nil];
+	NSTextCheckingResult *match = [expression firstMatchInString:value options:0 range:NSMakeRange(0, value.length)];
+	return match != nil && NSEqualRanges(match.range, NSMakeRange(0, value.length));
+}
+
+/** Keep this narrow lexical grammar identical to MobileConfiguration.kt and mobile-configuration.ts. */
+static NSString *TFMobileOrigin(NSString *value) {
+	if (value.length == 0 || value.length > 2048) return nil;
+	NSRegularExpression *expression = [NSRegularExpression regularExpressionWithPattern:
+		@"\\A[Hh][Tt][Tt][Pp][Ss]://([A-Za-z0-9.-]+)(?::([1-9][0-9]{0,4}))?/?\\z" options:0 error:nil];
+	NSTextCheckingResult *match = [expression firstMatchInString:value options:0 range:NSMakeRange(0, value.length)];
+	if (!match || !NSEqualRanges(match.range, NSMakeRange(0, value.length))) return nil;
+	NSString *host = [[value substringWithRange:[match rangeAtIndex:1]] lowercaseString];
+	NSArray<NSString *> *labels = [host componentsSeparatedByString:@"."];
+	if (host.length > 253) return nil;
+	for (NSString *label in labels) {
+		if (!TFMobileMatches(label, @"\\A[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\z")) return nil;
+	}
+	unichar first = [labels.lastObject characterAtIndex:0];
+	if (first < 'a' || first > 'z') {
+		if (labels.count != 4) return nil;
+		for (NSString *label in labels) {
+			if (!TFMobileMatches(label, @"\\A(?:0|[1-9][0-9]{0,2})\\z") || label.integerValue > 255) return nil;
+		}
+	}
+	NSRange portRange = [match rangeAtIndex:2];
+	NSInteger port = portRange.location == NSNotFound ? 443 : [value substringWithRange:portRange].integerValue;
+	if (port > 65535) return nil;
+	return port == 443 ? [@"https://" stringByAppendingString:host] : [NSString stringWithFormat:@"https://%@:%ld", host, (long)port];
+}
+
+@interface TFMobileConfiguration ()
+- (instancetype)initWithOrigin:(NSString *)origin credential:(NSString *)credential;
+@end
+
+@implementation TFMobileConfiguration
+- (instancetype)initWithOrigin:(NSString *)origin credential:(NSString *)credential {
+	if ((self = [super init])) {
+		_apiOrigin = [origin copy];
+		_credential = [credential copy];
+	}
+	return self;
+}
+- (NSString *)description { return @"TFMobileConfiguration"; }
+- (NSString *)debugDescription { return @"TFMobileConfiguration"; }
+
++ (instancetype)parse:(id)input error:(NSError **)error {
+	if (error) *error = nil;
+	@try {
+		if (![input isKindOfClass:NSArray.class] || [input count] != 2) {
+			if (error) *error = TFMobileConfigurationFailure();
+			return nil;
+		}
+		NSString *origin = nil;
+		NSString *credential = nil;
+		for (id item in (NSArray *)input) {
+			if (![item isKindOfClass:NSString.class] || [item length] > 2080) {
+				if (error) *error = TFMobileConfigurationFailure();
+				return nil;
+			}
+			NSString *text = item;
+			NSRange separator = [text rangeOfString:@"="];
+			if (separator.location == NSNotFound || separator.location == 0) {
+				if (error) *error = TFMobileConfigurationFailure();
+				return nil;
+			}
+			NSString *key = [text substringToIndex:separator.location];
+			NSString *value = [text substringFromIndex:separator.location + 1];
+			if ([key isEqualToString:@"apiOrigin"] && !origin) {
+				origin = TFMobileOrigin(value);
+				if (origin) continue;
+			} else if ([key isEqualToString:@"credential"] && !credential) {
+				if (value.length == 58 && TFMobileMatches(value, @"\\Atf_public_[0-9a-f]{48}\\z")) {
+					credential = [value copy];
+					continue;
+				}
+			}
+			// Missing, repeated, unknown or malformed fields have the same safe failure.
+			if (error) *error = TFMobileConfigurationFailure();
+			return nil;
+		}
+		if (origin && credential) return [[self alloc] initWithOrigin:origin credential:credential];
+	} @catch (NSException *exception) {
+		// Do not inspect or forward an exception that could contain a configured value.
+		(void)exception;
+	}
+	if (error) *error = TFMobileConfigurationFailure();
+	return nil;
+}
+
++ (instancetype)fromInfo:(NSDictionary *)info localized:(NSDictionary *)localized error:(NSError **)error {
+	if (error) *error = nil;
+	@try {
+		if ([info isKindOfClass:NSDictionary.class] &&
+			(!localized || [localized isKindOfClass:NSDictionary.class]) &&
+			!localized[@"TileflowMobileConfiguration"]) {
+			return [self parse:info[@"TileflowMobileConfiguration"] error:error];
+		}
+	} @catch (NSException *exception) { (void)exception; }
+	if (error) *error = TFMobileConfigurationFailure();
+	return nil;
+}
+@end
+
+@implementation TFMobileConfigurationCache {
+	NSInteger _phase;
+	TFMobileConfiguration *_configuration;
+}
+- (TFMobileConfiguration *)read:(TFMobileConfiguration *(^)(void))source error:(NSError **)error {
+	if (error) *error = nil;
+	@synchronized (self) {
+		if (_phase == 2) return _configuration;
+		if (_phase == 0) {
+			_phase = 1;
+			@try {
+				TFMobileConfiguration *value = source();
+				if (value && _phase == 1) {
+					_configuration = value;
+					_phase = 2;
+					return value;
+				}
+			} @catch (NSException *exception) { (void)exception; }
+		}
+		_phase = 3;
+		_configuration = nil;
+		if (error) *error = TFMobileConfigurationFailure();
+		return nil;
+	}
+}
+@end

package/ios/TFNativeAdmissionURLProtocol.mm

@@ -0,0 +1,69 @@
+#import "TFAdmissionInstallation.h"
+#import <atomic>
+
+static __weak TFAdmissionInstallation *TFActiveInstallation;
+
+@interface TFNativeAdmissionURLProtocol () {
+	std::atomic_bool _stopped;
+}
+@property (atomic, strong, nullable) id<TFAdmissionCancel> cancellation;
+@end
+
+@implementation TFNativeAdmissionURLProtocol
++ (TFAdmissionInstallation *)activeInstallation {
+	@synchronized(self) { return TFActiveInstallation; }
+}
++ (void)setActiveInstallation:(TFAdmissionInstallation *)installation {
+	@synchronized(self) { TFActiveInstallation = installation; }
+}
++ (BOOL)canInitWithRequest:(NSURLRequest *)request {
+	// This class is installed only in MapLibre's configuration. Reserved
+	// requests remain ours even after retirement or loss of installation.
+	return TFAdmissionHasReservedContext(request.URL.absoluteString);
+}
++ (BOOL)canInitWithTask:(NSURLSessionTask *)task {
+	return [self canInitWithRequest:task.currentRequest ?: task.originalRequest];
+}
++ (NSURLRequest *)canonicalRequestForRequest:(NSURLRequest *)request {
+	// Preserve the non-secret discriminator in MapLibre's cache identity.
+	return request;
+}
+- (instancetype)initWithRequest:(NSURLRequest *)request cachedResponse:(NSCachedURLResponse *)cachedResponse client:(id<NSURLProtocolClient>)client {
+	if ((self = [super initWithRequest:request cachedResponse:cachedResponse client:client])) _stopped.store(false);
+	return self;
+}
+- (void)startLoading {
+	TFAdmissionInstallation *installation = [TFNativeAdmissionURLProtocol activeInstallation];
+	if (!installation) {
+		if (!_stopped.exchange(true)) [self.client URLProtocol:self didFailWithError:TFAdmissionSafeError()];
+		return;
+	}
+	__weak TFNativeAdmissionURLProtocol *weakSelf = self;
+	self.cancellation = [installation.engine request:self.request
+		response:^(NSHTTPURLResponse *response, NSData *body) {
+			TFNativeAdmissionURLProtocol *strongSelf = weakSelf;
+			if (!strongSelf || strongSelf->_stopped.load()) return;
+			[strongSelf.client URLProtocol:strongSelf didReceiveResponse:response cacheStoragePolicy:NSURLCacheStorageNotAllowed];
+			if (!strongSelf->_stopped.load()) [strongSelf.client URLProtocol:strongSelf didLoadData:body];
+			if (!strongSelf->_stopped.load()) [strongSelf.client URLProtocolDidFinishLoading:strongSelf];
+			strongSelf->_stopped.store(true); strongSelf.cancellation = nil;
+		}
+		failure:^{
+			TFNativeAdmissionURLProtocol *strongSelf = weakSelf;
+			if (strongSelf && !strongSelf->_stopped.exchange(true)) [strongSelf.client URLProtocol:strongSelf didFailWithError:TFAdmissionSafeError()];
+			strongSelf.cancellation = nil;
+		}
+		delegate:^id<TFAdmissionCancel>(NSURLRequest *request, TFAdmissionNetworkCompletion completion) {
+			return [installation delegateRequest:request mayStart:^BOOL {
+				TFNativeAdmissionURLProtocol *strongSelf = weakSelf;
+				return strongSelf && !strongSelf->_stopped.load() && [installation.engine isOwner];
+			} completion:completion];
+		}];
+	if (_stopped.load()) [self.cancellation cancel];
+}
+- (void)stopLoading {
+	_stopped.store(true);
+	[self.cancellation cancel];
+	self.cancellation = nil;
+}
+@end