Developers

The same SDK our own apps are built on.

Every Tanvrit app — point of sale, storefront, community, school — is a thin layer over one Kotlin Multiplatform SDK and one HTTP API. Both are published, both are documented, and this page says plainly which parts you can pull today and which still need a credential from us.

25

SDK modules in settings.gradle.kts

4

Foundation modules under com.tanvrit:core*

6

Kotlin compile targets from one source set

11,600+

Automated test functions across core, SDK and backend

The stack

One Kotlin source tree, six compiled targets

The SDK's settings.gradle.kts declares 25 module builds — two of them opt-in development samples behind an env flag, the rest published as com.tanvrit:<module>. They compile to 6 Kotlin targets: Android, JVM, iOS arm64, iOS simulator arm64, WasmJS and JS. Models, networking, storage, auth and a Compose Multiplatform component library are written once in commonMain and shipped to all of them.

  • storage — a hand-rolled documents-table SQLite layer with an in-memory cache, dual-write and a typed sync engine that retries transient failures with backoff and dead-letters bounded 4xx
  • auth — token storage namespaced per app id, refresh under a mutex, OAuth/PKCE and passkey flows
  • commerce, customers, business, social, communication, media — the domain layers our own apps consume
  • ui, auth-ui, business-ui, commerceui — Compose Multiplatform screens and design-system tokens
  • test-support — the harness our modules test against, published alongside them

Four foundation modules everything else sits on

A separate repository publishes 4 foundation artifacts that the SDK, the backend and every app depend on. core-base owns BaseDataClass, the AppJson serialization contract, the Ktor client with retry and backoff, and certificate pinning that fails closed in production builds. core-auth owns the auth contract and token-storage abstraction. core-business owns workspace and business identity primitives. core aggregates the three and adds the shared domain model layer.

  • Wire format is stable by policy: @SerialName values are never renamed, because MongoDB documents, API JSON and on-device caches all key off them
  • PII fields are encrypted before they are written, with a dedicated serializer
  • The foundation and the SDK release on independent version lines, so consumers pin the two separately

Artifacts are served by a credential-free proxy

maven.tanvrit.com is a Cloudflare Worker in front of an R2 bucket. It reads R2 first and falls back to GitHub Packages on a miss, writing the result back into R2 so the fallback path decays. Reads are unauthenticated on purpose: a compiled Kotlin artifact served with no credential is not made private by gating a second copy of it elsewhere. Version metadata is always fetched fresh; versioned artifacts are immutable and cached as such.

  • GET https://maven.tanvrit.com/com/tanvrit/core/2.0.62/core-2.0.62.pom returns 200 with no Authorization header — checked 2026-08-11
  • The same host serves a read-only npm registry at /npm for the TypeScript client package
  • The Worker keeps an explicit module allowlist, so a brand-new module is unreachable until it is added there

A POST-RPC API, documented in OpenAPI

The backend is a Ktor 3.5.1 service on MongoDB at api.tanvrit.com. Endpoints are POST-RPC rather than REST-by-verb — the operation is in the path, and every response comes back in the same envelope: status, message, payload. The reference at developers.tanvrit.com is assembled from 20 hand-authored per-feature OpenAPI documents plus a shared base, bundled into one spec that the portal renders and that you can download and generate a client from.

  • Authentication is a bearer JWT from the auth endpoints, or an X-API-Key for the AI commerce gateway
  • Every request also carries X-App-ID — the platform is multi-tenant end to end, down to the permission cache key
  • The spec is a committed, served artifact regenerated from its per-feature sources, so the published reference and the sources cannot silently diverge

Adding it to a build

settings.gradle.kts

Add the artifact host. Reads need no credentials.

dependencyResolutionManagement {
    repositories {
        google()
        mavenCentral()
        maven("https://maven.tanvrit.com")
    }
}

build.gradle.kts

Depend on the modules you need. The foundation and the SDK are on independent version lines — pin them separately rather than sharing one constant.

kotlin {
    androidTarget()
    jvm()
    iosArm64()
    iosSimulatorArm64()
    wasmJs { browser() }
    js(IR) { browser() }

    sourceSets {
        commonMain.dependencies {
            implementation("com.tanvrit:core:2.0.62")     // foundation
            implementation("com.tanvrit:auth:2.0.61")     // SDK
            implementation("com.tanvrit:commerce:2.0.61")
            implementation("com.tanvrit:storage:2.0.61")
        }
        // Compose pulls an older Wasm stdlib; pin it to the Kotlin version
        // or the build fails with "Symbol for Any not found".
        wasmJsMain.dependencies {
            implementation("org.jetbrains.kotlin:kotlin-stdlib-wasm-js:2.4.0")
        }
    }
}

build.gradle.kts

There is also a convention plugin that adds the repository and wires the modules for you. It resolves from GitHub Packages, so it needs a token today — see the access table below. Set version explicitly; the plugin's built-in default is an old release.

plugins {
    id("com.tanvrit.sdk") version "<plugin version>"
}

tanvrit {
    version = "2.0.61"
    modules = listOf("core", "auth", "commerce")
}

HTTP

Calling the API directly. POST-RPC, one envelope shape, tenant header on every request.

POST https://api.tanvrit.com/api/auth/LOGIN_EMAIL
X-App-ID: com.example.yourapp
Content-Type: application/json

{ "email": "you@example.com", "password": "..." }

→ 200
{
  "status": "SUCCESS",
  "message": "...",
  "payload": { "access_token": "...", "refresh_token": "..." }
}

What you can pull today

Some of this is genuinely open and some of it still needs a credential from us. Rather than let you find out at a 401, here is the split.

SDK and foundation artifacts on maven.tanvrit.com

Open

Anonymous GET returns 200 for core, core-auth, auth, ui, commerce, storage, business, media, hosting, mesh and test-support. No account, no token.

OpenAPI reference at developers.tanvrit.com

Open

The portal and the bundled spec are public. Calling the API itself needs an app id and credentials issued by us.

com.tanvrit.sdk Gradle convention plugin

Credential required

Published to GitHub Packages, not to maven.tanvrit.com — the plugin marker returns 404 there. Use the plain dependency block above unless we have given you access.

API keys and app ids for api.tanvrit.com

By request

There is no public self-serve signup for API credentials yet. Talk to us and we will issue them.

SmritiDB

Open source

Apache-2.0 on GitHub, with the TypeScript binding published to public npm. Other bindings build from source in the repository.

Open standards

SmritiDB — an open standard we publish, not a product we sell

Storage that remembers like you do.

SmritiDB is a separate, Apache-2.0 project: an associative storage layer addressed by meaning rather than by exact key. It is built on sparse distributed memory and binary hyperdimensional computing — Pentti Kanerva's 1988 model — so you write data and recall it later from a partial cue, ranked by similarity. One Rust core drives every binding through PyO3, UniFFI, wasm-bindgen or a stable C ABI, and a shared conformance corpus holds them to the same bytes: a snapshot written from one language opens byte-identically in the others.

  • Fuzzy content-addressing — look items up by similarity, not by hash

  • Holographic distribution — losing part of the substrate blurs everything slightly instead of dropping specific records

  • Hebbian consolidation — items you access together get bound closer over time

  • One Rust core; bindings for Python, Kotlin Multiplatform, TypeScript/WASM and a stable C ABI for Go, Dart and .NET

  • Not a transactional database or a vector-DB clone — it sits beside your exact-byte storage, not in front of it

Questions

Can I use the SDK without an account?
You can resolve and compile against it: maven.tanvrit.com answers anonymous reads, so adding the repository and a com.tanvrit dependency is enough to build. Making live calls is a separate question — the API needs an app id and credentials we issue, and there is no self-serve signup for those yet.
Which platforms does one dependency actually cover?
A module published here compiles for 6 Kotlin targets: Android, JVM, iOS arm64, iOS simulator arm64, WasmJS and JS. The common source set is the real implementation; platform source sets only supply what genuinely differs, such as the SQLite driver and secure storage.
Why are the foundation and SDK versions different?
They are separate repositories on separate release trains, so com.tanvrit:core and com.tanvrit:auth are not guaranteed to carry the same number. Consumers pin two version constants rather than one. Collapsing them into a single constant is the most common way a build starts failing to resolve.
Is the API REST?
Not in the verb-mapped sense. Operations are POST endpoints named after the operation, and every response uses one envelope — status, message, payload — so client error handling is uniform. The full contract is published as OpenAPI at developers.tanvrit.com and can be fed to a generator.
Is SmritiDB part of the Tanvrit SDK?
No. It is a standalone Apache-2.0 project with its own repository, specification and conformance suite, published as an open standard. Nothing on this page requires it, and using it does not require anything of ours.