<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.attacker.twapoc">

    <!-- Zero dangerous permissions. INTERNET only so the TWA page can phone
         home (and INTERNET is install-time / not user-surfaced). -->
    <uses-permission android:name="android.permission.INTERNET" />

    <application
        android:label="TWA POC"
        android:allowBackup="false">

        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <!-- Digital Asset Links default origin so Chrome's TwaVerifier accepts
             this package as the owner of https://attacker.example. -->
        <meta-data
            android:name="asset_statements"
            android:resource="@string/asset_statements" />
    </application>
</manifest>
