[huhuanming]

Add a private source-built @onekeyfe/react-native-intercom package targeting React Native 0.88 / React 19.3, New Architecture. Preserve the Intercom RN 10.8.1 public API and Android 18.10.0 / iOS 19.9.1 behavior, including cards/sheets, remote Web JavaScript and native bridges.

Build and integration

• Keep the native sources/resources, required Android source-build inputs and tools, README/SPEC and license notices. Exclude historical reports, diagnostics, experiments and unused metadata. All 3,822 required source-build inputs are tracked and included in the package.
• Keep Git free of generated Android Maven artifacts. prepack builds JavaScript/declarations and unconditionally rebuilds the native sources, then includes exactly two own-source AARs and two POMs in the SDK archive. No checksum sidecars, module/version metadata, build intermediates or receipts enter the package.
• Require the SDK producer toolchain only when packing: Python 3.9+, JDK 17/24, Gradle 8.13 and Android SDK platforms 35/36/build-tools 35.0.0. Resolve tools from documented environment variables rather than machine-specific paths. SHA-pinned external dependency caches never replace native compilation.
• Invalidate old Maven output before Python producer preflight, stage the full generated set, and check the source/scripts/tools file inventory and hashes before promotion. Producer failures leave no old or partial consumer artifact set; failed packing creates no new archive. Source-checkout consumers receive an actionable missing-artifact error rather than triggering native production inside Gradle.
• Registry/tgz installs consume the packaged artifacts without invoking the native producer. prepare remains JavaScript/declarations only; no install/postinstall native build is added. POMs preserve the effective original dependency graph (base 138 / UI 65 components).
• Android minimum SDK 24 and iOS minimum 15.1 under RN 0.88. No App dependency migration or package publication. The package remains private; shared publication CI and its toolchain remain unchanged.

Validation

• Real source-only npm pack with no SDK compiled outputs, plus real Yarn 4.1 packing: both final archives contain 4,988 files, the four generated Maven artifacts and all required source/JS/type inputs. No hidden build/cache/report entries leak into either archive. Protected native/bridge inputs match the baseline; regenerated Maven bytes also match it.
• A changed Java method body in an isolated source fixture changes the packaged class bytes; native output is actually recompiled. Added/deleted/modified input checks, stale Kotlin module metadata cleanup, SHA cache checks and toolchain preflight probes pass.
• Normal npm/Yarn installation of the final tgz succeeds without invoking the native SDK producer. Missing tools and actual compilation-failure cases reject packing without a new archive.
• A fresh RN 0.88 Android arm64 New Architecture Host using the final source-only tgz passes complete assembleDebug, Codegen, C++/JSI linkage, AAPT and duplicate-class checks. Its actual APK contains the native SDK, wrapper and generated module implementation, resolving both own-source Maven components from the installed package.
• Earlier SDK validation covered isolated RN 0.88 iOS static-library and dynamic-framework consumers: Pods/Codegen, arm64/x86_64 simulator build/link and installed/launched resource smoke. This packaging revision leaves those native sources/resources unchanged; it does not repeat full iOS runtime acceptance.
• Repository test-integrity and npm dist-tag checks pass. Astra design/acceptance and a separate independent packaging review completed; review findings were fixed and rechecked.

Acceptance boundary

This remains a draft source SDK. Full backend sessions, native UI/cards/sheets/media/push parity, real-device acceptance and private Swift ABI compatibility remain unaccepted. The producer was exercised on macOS; Linux execution remains unverified. Android APK validation is a build check, not a launch/runtime check. Security remediation and security re-auditing are explicitly deferred: clipboard behavior, remote Web JavaScript and bridge behavior remain unchanged, with no safety claim.

Raw imported-source whitespace and semantic empty TSV columns are preserved. The repository has no agent:check script; its actual package and repository checks were used.