@tinkerlandai/indiana-react-native 0.9.1 → 0.9.5

package/native-sdk/android/java/ai/tinkerland/indiana/IndianaClient.kt

@@ -0,0 +1,526 @@
+package ai.tinkerland.indiana
+
+import android.app.Activity
+import android.content.Context
+import org.json.JSONObject
+import java.util.UUID
+import java.time.Instant
+import java.lang.ref.WeakReference
+import java.util.concurrent.atomic.AtomicReference
+import java.util.concurrent.atomic.AtomicBoolean
+import org.json.JSONArray
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+
+enum class IndianaSubscriptionProvider(val value: String) { STRIPE("stripe"), APPLE("apple"), GOOGLE("google") }
+data class IndianaSubscriptionPlan(val productVersionId: UUID, val seatQuantities: Map<String, Int> = emptyMap(), val featureQuantities: Map<UUID, Int> = emptyMap())
+
+interface IndianaGoogleStore: AutoCloseable {
+    suspend fun connect()
+    suspend fun quote(productId: String, basePlanId: String?, offerId: String?): GoogleQuote
+    suspend fun purchase(activity: Activity, productId: String, basePlanId: String?, offerId: String?, obfuscatedAccountId: String, obfuscatedProfileId: String, terms: GoogleStoreTerms)
+    suspend fun scanPurchases(membership: Boolean): List<GooglePurchaseEvidence>
+}
+/** Current customer session and independent subscription operations. */
+class IndianaClient internal constructor(private val configuration: IndianaConfiguration, http: IndianaHTTP, private val funnelStorage: ((String) -> IndianaFunnelCommandStorage)? = null, private val publicPaywallContent: (suspend (JSONObject) -> JSONObject)? = null, private val pushStorage: (() -> IndianaPushStorage)? = null, sessionNow: () -> Instant = Instant::now): AutoCloseable {
+    constructor(context: Context, configuration: IndianaConfiguration): this(configuration, IndianaURLTransport(configuration), { token -> IndianaFunnelCommandKeystore(context.applicationContext,configuration,token) }, null, { IndianaPushKeystore(context.applicationContext, configuration.scope) })
+    private val http = IndianaSessionTransport(http, configuration.scope, sessionNow)
+    private data class Identity(val token: String?, val epoch: UUID)
+    private val identity = AtomicReference(Identity(null, UUID.randomUUID()))
+    private val identityLock = Any()
+    private var pushIdentity: IndianaPushIdentity? = null
+    private var pushBindingSequence = 0L
+    private val pushClientID = UUID.randomUUID()
+    private var pushObservationID = UUID.randomUUID()
+    private val pushScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val pushSyncLock = Mutex()
+    @Volatile var pushSynchronizationError: String? = null
+        private set
+    private val funnels = mutableListOf<WeakReference<IndianaFunnelSession>>()
+    private val paywalls = mutableListOf<WeakReference<IndianaPaywallSession>>()
+    private val contents = mutableListOf<WeakReference<IndianaContentSession>>()
+    private val featuresClients = mutableListOf<WeakReference<IndianaFeatureClient>>()
+    private val analyticsEvents = mutableListOf<JSONObject>()
+    private val analyticsFlushLock = Mutex()
+    private var analyticsTimer: kotlinx.coroutines.Job? = null
+    private val closed = AtomicBoolean(false)
+    private val storeRestorePending = java.util.concurrent.ConcurrentHashMap<String, Pair<UUID, String>>()
+    private val recoveringNative = AtomicBoolean(false)
+    private val nativeReceiptPending = java.util.concurrent.ConcurrentHashMap<UUID, Pair<UUID, String>>()
+    fun identify(customerToken: String) = synchronized(identityLock) {
+        if (!customerToken.matches(Regex("gg_ct_[A-Za-z0-9_-]{32,128}"))) throw IndianaClientException("unauthenticated")
+        installIdentity(customerToken, null)
+    }
+    private fun installIdentity(customerToken: String, session: IndianaCustomerSession?) {
+        checkOpen(); pushIdentity?.let { pushBindingSequence = it.reserve(); pushSynchronizationError = null }
+        analyticsTimer?.cancel(); analyticsTimer = null; analyticsEvents.clear()
+        val next = Identity(customerToken, UUID.randomUUID())
+        val invalidated = { invalidateSession(next.epoch) }
+        if (session == null) http.identify(customerToken, invalidated) else http.identify(session, invalidated)
+        pushObservationID = UUID.randomUUID(); nativeReceiptPending.clear(); storeRestorePending.clear(); identity.set(next); funnels.forEach { it.get()?.reset() }; funnels.clear(); paywalls.forEach { it.get()?.close() }; paywalls.clear()
+        contents.forEach { it.get()?.close() }; contents.clear()
+        featuresClients.forEach { it.get()?.close() }; featuresClients.clear(); schedulePush()
+    }
+    fun identify(session: IndianaCustomerSession) = synchronized(identityLock) { session.validate(); installIdentity(session.accessToken, session) }
+    suspend fun refreshSession(): IndianaCustomerSession = http.refresh()
+    /** A host-owned session supplies Access Tokens; its Refresh Token never crosses the bridge. */
+    fun setAccessTokenProvider(provider: (suspend () -> String)?) { http.setAccessTokenProvider(provider) }
+    @JvmOverloads fun funnel(runToken: String, commandStorage: IndianaFunnelCommandStorage? = null): IndianaFunnelSession = synchronized(identityLock) {
+        checkOpen(); val session = IndianaFunnelSession(configuration, http, runToken, commandStorage ?: funnelStorage?.invoke(runToken))
+        identity.get().token?.let { session.identify(it) }; funnels.removeAll { it.get() == null }; funnels.add(WeakReference(session)); session
+    }
+    @JvmOverloads fun paywall(paywallId: UUID? = null, paywallVersionId: UUID? = null, provider: IndianaSubscriptionProvider, currency: String, locale: String = "en"): IndianaPaywallSession = synchronized(identityLock) {
+        checkOpen(); val token = identity.get().token ?: throw IndianaClientException("unauthenticated")
+        val session = IndianaPaywallSession(configuration, http, token, paywallId, paywallVersionId, provider, currency, locale, publicPaywallContent ?: IndianaPaywallContent(configuration)::resolve)
+        paywalls.removeAll { it.get() == null }; paywalls.add(WeakReference(session)); session
+    }
+    private fun clearIdentity() {
+        analyticsTimer?.cancel(); analyticsTimer = null; analyticsEvents.clear()
+        try { pushIdentity?.reserve(detach = true); pushSynchronizationError = null } catch (_: Exception) { pushSynchronizationError = "protected_storage_unavailable" }
+        pushObservationID = UUID.randomUUID(); pushBindingSequence = 0; nativeReceiptPending.clear(); storeRestorePending.clear(); identity.set(Identity(null, UUID.randomUUID())); funnels.forEach { it.get()?.reset() }; funnels.clear(); paywalls.forEach { it.get()?.close() }; paywalls.clear()
+        contents.forEach { it.get()?.close() }; contents.clear()
+        featuresClients.forEach { it.get()?.close() }; featuresClients.clear(); schedulePush()
+    }
+    private fun invalidateSession(epoch: UUID) = synchronized(identityLock) {
+        if (identity.get().epoch == epoch) clearIdentity()
+    }
+    fun reset() = synchronized(identityLock) {
+        http.identify(null)
+        clearIdentity()
+    }
+    /** Relay attaches the server API key on your backend. No run credential is needed, even after run expiry. */
+    suspend fun recoverNativeOrders(context: Context, relay: suspend (JSONObject) -> JSONObject): List<JSONObject> = recoverOrders(IndianaNativePendingKeystore(context, configuration.scope), GoogleStorefront(context) { }, relay)
+    internal suspend fun recoverOrders(storage: IndianaNativePendingStorage, store: IndianaGoogleStore, relay: suspend (JSONObject) -> JSONObject): List<JSONObject> {
+        checkOpen(); val actor = identity.get(); val token = actor.token ?: throw IndianaClientException("unauthenticated")
+        if (configuration.scope.environment != IndianaEnvironment.SANDBOX || !recoveringNative.compareAndSet(false, true)) throw IndianaClientException("command_pending")
+        try {
+            store.connect(); val records = storage.orders()
+            val purchases = store.scanPurchases(false) + store.scanPurchases(true)
+            val responses = mutableListOf<JSONObject>()
+            for (record in records) {
+                checkOpen(); if (identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                val receipt = purchases.singleOrNull { it.productId == record.productId && it.accountBinding == record.accountId && it.intentBinding == record.profileId }
+                val command = nativeReceiptPending[record.orderId] ?: run {
+                    val requestId = UUID.randomUUID()
+                    if (receipt != null && receipt.purchaseToken.toByteArray().size > 16384) throw IndianaClientException("invalid_evidence")
+                    val evidence = receipt?.let { JSONObject().put("provider", "google").put("orderId", record.orderId.toString()).put("receiptId", record.receiptId.toString()).put("purchaseToken", it.purchaseToken) }
+                    requestId to JSONObject().put("operation", "native_receipt").put("requestId", requestId.toString()).put("customerToken", token).put("orderId", record.orderId.toString()).put("receiptId", record.receiptId.toString()).put("nativeEvidence", evidence ?: JSONObject.NULL).toString()
+                }.also { nativeReceiptPending[record.orderId] = it }
+                val credential = http.access()
+                if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                val outgoing = JSONObject(command.second).put("customerToken", credential)
+                val result = try { relay(outgoing) } catch (error: IndianaClientException) {
+                    if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                    val status = error.code.removePrefix("request_failed_").toIntOrNull()
+                    if (status != null && status < 500 && status != 425) { nativeReceiptPending.remove(record.orderId); if (status in setOf(403,404)) continue }
+                    throw error
+                }
+                if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                if (safe { scope(result.getJSONObject("scope")) } != configuration.scope || result.optString("requestId") != command.first.toString() || result.optString("orderId") != record.orderId.toString() || result.optString("receiptId") != record.receiptId.toString() || result.optString("orderStatus") !in setOf("created", "pending", "trialing", "paid", "cancelled", "failed") || result.opt("refunded") !is Boolean) throw IndianaClientException("invalid_response")
+                result.optJSONObject("nativeCompletion")?.let { completion ->
+                    if (completion.optString("orderId") != record.orderId.toString() || completion.optString("receiptId") != record.receiptId.toString() || completion.opt("membership") !is Boolean) throw IndianaClientException("invalid_response")
+                    val ids = completion.getJSONArray("transactionIds"); if (ids.length() !in 1..50 || (0 until ids.length()).any { ids.opt(it) !is String || ids.getString(it).length !in 1..255 } || (0 until ids.length()).map { ids.getString(it) }.distinct().size != ids.length()) throw IndianaClientException("invalid_response")
+                    if (!completion.getBoolean("membership")) storage.remove(record.orderId)
+                }
+                nativeReceiptPending.remove(record.orderId); responses.add(JSONObject(result.toString()))
+            }
+            return responses
+        } finally { store.close(); recoveringNative.set(false) }
+    }
+    /** Reinstall and device-change recovery uses the store's current transactions, never a local order journal. */
+    suspend fun restorePurchases(context: Context): List<JSONObject> = restoreStorePurchases(GoogleStorefront(context) {})
+    internal suspend fun restoreStorePurchases(store: IndianaGoogleStore): List<JSONObject> {
+        checkOpen(); val actor = identity.get(); if (actor.token == null) throw IndianaClientException("unauthenticated")
+        if (!recoveringNative.compareAndSet(false,true)) throw IndianaClientException("command_pending")
+        try {
+            store.connect(); val purchases = store.scanPurchases(false) + store.scanPurchases(true)
+            if (purchases.size > 100) throw IndianaClientException("invalid_response")
+            return purchases.mapNotNull { purchase ->
+                if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                val intent = purchase.intentBinding?.let { runCatching { UUID.fromString(it) }.getOrNull() }
+                // Unbound historical purchases are not automatically transferred to a signed-in app account.
+                intent?.let { submitStorePurchase(purchase,it,actor.epoch) }
+            }
+        } finally { store.close(); recoveringNative.set(false) }
+    }
+    private suspend fun submitStorePurchase(purchase: GooglePurchaseEvidence, intent: UUID, original: UUID): JSONObject {
+        if (purchase.purchaseToken.toByteArray().size > 16384) throw IndianaClientException("invalid_evidence")
+        val command = storeRestorePending[purchase.purchaseToken] ?: run {
+            val id = UUID.randomUUID()
+            id to JSONObject().put("requestId",id.toString()).put("provider","google").put("purchaseIntentId",intent.toString()).put("productId",purchase.productId).put("purchaseToken",purchase.purchaseToken).toString()
+        }.also { storeRestorePending[purchase.purchaseToken] = it }
+        val result = authenticated("subscriptions/native/restore",JSONObject(command.second))
+        if (identity.get().epoch != original || closed.get()) throw IndianaClientException("identity_changed")
+        val operation = result.optJSONObject("operation") ?: throw IndianaClientException("invalid_response")
+        if (operation.optString("requestId") != command.first.toString() || operation.optString("purchaseIntentId") != intent.toString() || runCatching { UUID.fromString(operation.getString("orderId")) }.isFailure || operation.optString("status") !in setOf("created","pending","trialing","paid","cancelled","failed") || operation.opt("refunded") !is Boolean || !operation.has("completion")) throw IndianaClientException("invalid_response")
+        operation.optJSONObject("completion")?.let { completion ->
+            val ids = completion.optJSONArray("transactionIds") ?: throw IndianaClientException("invalid_response")
+            if (completion.opt("membership") !is Boolean || ids.length() !in 1..50 || (0 until ids.length()).any { ids.opt(it) !is String || ids.getString(it).length !in 1..255 } || (0 until ids.length()).map { ids.getString(it) }.distinct().size != ids.length()) throw IndianaClientException("invalid_response")
+        }
+        storeRestorePending.remove(purchase.purchaseToken); return result
+    }
+    /** Uses the fixed server instruction and actual Play quote; the server owns acknowledgement and grants. */
+    suspend fun purchaseSubscription(activity: Activity, operationId: UUID, confirm: suspend (GoogleQuote) -> Boolean): JSONObject {
+        if (!recoveringNative.compareAndSet(false,true)) throw IndianaClientException("command_pending")
+        try { return purchaseSubscriptionInternal(activity,operationId,false,confirm) } finally { recoveringNative.set(false) }
+    }
+    /** Uses a verified source purchase token and full-price Play replacement. */
+    suspend fun switchSubscription(activity: Activity, operationId: UUID, confirm: suspend (GoogleQuote) -> Boolean): JSONObject {
+        if (!recoveringNative.compareAndSet(false,true)) throw IndianaClientException("command_pending")
+        try { return purchaseSubscriptionInternal(activity,operationId,true,confirm) } finally { recoveringNative.set(false) }
+    }
+    private suspend fun purchaseSubscriptionInternal(activity: Activity, operationId: UUID, replacing:Boolean, confirm: suspend (GoogleQuote) -> Boolean): JSONObject {
+        checkOpen(); val actor = identity.get(); if (actor.token == null) throw IndianaClientException("unauthenticated")
+        val response = if(replacing) update(operationId) else attach(operationId); val operation = response.optJSONObject("operation") ?: throw IndianaClientException("invalid_response")
+        if (operation.optString("operationId") != operationId.toString()) throw IndianaClientException("invalid_response")
+        if (operation.optString("status") in listOf("complete","effective","cancelled","failed")) return response
+        val instruction = operation.optJSONObject("nativePurchase") ?: throw IndianaClientException("invalid_response")
+        if (instruction.optString("provider") != "google" || instruction.optString("receiptId") != operationId.toString()) throw IndianaClientException("invalid_response")
+        val order = safe { UUID.fromString(text(instruction,"orderId")) }
+        if (instruction.optString("obfuscatedProfileId") != order.toString()) throw IndianaClientException("invalid_response")
+        val product = text(instruction,"productId"); val basePlan = instruction.opt("basePlanId") as? String; val offer = instruction.opt("offerId") as? String
+        var terms = GoogleStoreTerms.parse(instruction); val result = CompletableDeferred<GoogleStoreResult>()
+        val store = GoogleStorefront(activity) { result.complete(it) }
+        try {
+            store.connect()
+            val scanned=store.scanPurchases(false)+store.scanPurchases(true)
+            if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+            val replacement=instruction.optJSONObject("replacement")
+            if (replacing != (replacement != null) || (replacement != null && replacement.optString("policy") != "google_full_price")) throw IndianaClientException("invalid_response")
+            val purchased = scanned.singleOrNull { it.intentBinding == order.toString() && it.productId == product && it.accountBinding == text(instruction,"obfuscatedAccountId") }
+            if (purchased != null) return submitStorePurchase(purchased,order,actor.epoch)
+            if (replacement != null) {
+                terms=terms.copy(replacement=googleReplacement(instruction,scanned))
+            }
+            val quote = terms.validate(store.quote(product,basePlan,offer)).copy(replacementPolicy=if(replacing) "google_full_price" else null); val accepted = confirm(quote)
+            if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+            if (!accepted) return if(replacing) update(operationId,"cancel") else attach(operationId,"cancel")
+            store.purchase(activity,product,basePlan,offer,text(instruction,"obfuscatedAccountId"),order.toString(),terms)
+            val outcome = result.await()
+            if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+            return when (outcome) {
+                is GoogleStoreResult.Purchased -> {
+                    if (outcome.evidence.productId != product || outcome.evidence.intentBinding != order.toString()) throw IndianaClientException("invalid_response")
+                    submitStorePurchase(outcome.evidence,order,actor.epoch)
+                }
+                is GoogleStoreResult.Canceled -> if(replacing) update(operationId,"cancel") else attach(operationId,"cancel")
+                is GoogleStoreResult.Failed -> throw IndianaClientException(outcome.code)
+            }
+        } finally { store.close() }
+    }
+    suspend fun features(activity: Activity, attributes: JSONObject = JSONObject()): IndianaFeatureClient = kotlinx.coroutines.withContext(Dispatchers.Main.immediate) {
+        checkOpen(); val original = identity.get()
+        if (original.token == null) throw IndianaClientException("unauthenticated")
+        val client = IndianaFeatureClient(activity, configuration, attributes) { operation, input -> customerOperation(operation, input) }
+        synchronized(identityLock) {
+            if (identity.get().epoch != original.epoch || closed.get()) { client.close(); throw IndianaClientException("identity_changed") }
+            featuresClients.removeAll { it.get() == null }; featuresClients.add(WeakReference(client))
+        }
+        client
+    }
+    /** Reuse requestId and the entire input after an unknown acceptance result. */
+    suspend fun startFunnel(input: JSONObject, commandStorage: IndianaFunnelCommandStorage? = null): IndianaFunnelSession {
+        val original = identity.get(); val token = original.token ?: throw IndianaClientException("unauthenticated")
+        val command = JSONObject(input.toString())
+        if (command.has("customer") || command.has("customerData") || command.has("customerId") || (command.has("operation") && command.optString("operation") != "start")) throw IndianaClientException("invalid_request")
+        command.put("operation", "start"); IndianaSchema.validate("command", command)
+        val result = http.send("funnels", "POST", token, command)
+        synchronized(identityLock) {
+            if (identity.get().epoch != original.epoch || closed.get()) throw IndianaClientException("identity_changed")
+            IndianaSchema.validate("response", result)
+            val run = result.getJSONObject("run")
+            if (scope(result.getJSONObject("scope")) != configuration.scope || result.has("customerId") || run.getJSONObject("source").getString("id") != command.getString("funnelId") || run.getString("locale") != command.getString("locale") || !IndianaSchema.equal(run.getJSONObject("parameters"), command.getJSONObject("parameters"))) throw IndianaClientException("invalid_response")
+            return funnel(result.getString("runToken"), commandStorage)
+        }
+    }
+    suspend fun track(name: String, properties: JSONObject = JSONObject(), eventId: UUID = UUID.randomUUID(), timestamp: java.util.Date = java.util.Date()) {
+        val event = JSONObject().put("eventUuid", eventId.toString()).put("timestamp", java.text.SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", java.util.Locale.US).apply { timeZone = java.util.TimeZone.getTimeZone("UTC") }.format(timestamp)).put("name", name).put("properties", JSONObject(properties.toString()))
+        val payload = JSONObject().put("events", JSONArray().put(event))
+        if (payload.toString().toByteArray().size > 60_000) throw IndianaClientException("invalid_request")
+        IndianaSchema.validate("customertrackEventsRequest", payload)
+        val full = synchronized(identityLock) {
+            checkOpen(); if (identity.get().token == null) throw IndianaClientException("unauthenticated")
+            if (analyticsEvents.size >= 1000) throw IndianaClientException("invalid_request")
+            analyticsEvents.add(event)
+            if (analyticsTimer == null) analyticsTimer = pushScope.launch { kotlinx.coroutines.delay(2_000); synchronized(identityLock) { analyticsTimer = null }; try { flush() } catch (_: Exception) { } }
+            analyticsEvents.size >= 100
+        }
+        if (full) flush()
+    }
+    suspend fun flush(): JSONObject = analyticsFlushLock.withLock {
+        val original = synchronized(identityLock) { analyticsTimer?.cancel(); analyticsTimer = null; identity.get() }
+        if (original.token == null) throw IndianaClientException("unauthenticated")
+        val total = JSONObject().put("inserted", 0).put("duplicates", 0).put("rejected", 0).put("skipped", 0)
+        var remaining = synchronized(identityLock) { analyticsEvents.size }
+        while (remaining > 0) {
+            val batch = synchronized(identityLock) {
+                if (identity.get().epoch != original.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                val selected = JSONArray()
+                for (event in analyticsEvents.take(minOf(remaining, 100))) {
+                    val candidate = JSONArray(selected.toString()).put(event)
+                    if (selected.length() > 0 && JSONObject().put("events", candidate).toString().toByteArray().size > 64_000) break
+                    selected.put(event)
+                }; selected
+            }
+            val result = customerOperation(IndianaCustomerOperation.trackEvents, JSONObject().put("events", batch))
+            if (listOf("inserted", "duplicates", "rejected", "skipped").sumOf { result.getInt(it) } != batch.length()) throw IndianaClientException("invalid_response")
+            synchronized(identityLock) {
+                if (identity.get().epoch != original.epoch || closed.get()) throw IndianaClientException("identity_changed")
+                repeat(batch.length()) { analyticsEvents.removeAt(0) }; remaining -= batch.length()
+            }
+            for (key in listOf("inserted", "duplicates", "rejected", "skipped")) total.put(key, total.getInt(key) + result.getInt(key))
+        }
+        total
+    }
+    suspend fun content(input: JSONObject, locale: String = "en", inputs: JSONObject = JSONObject()): IndianaContentSession {
+        val original = identity.get().epoch
+        val session = IndianaContentSession(configuration, input, locale, inputs) { request -> customerOperation(IndianaCustomerOperation.resolveContent, request) }
+        session.refresh()
+        synchronized(identityLock) {
+            if (identity.get().epoch != original || closed.get()) { session.close(); throw IndianaClientException("identity_changed") }
+            contents.removeAll { it.get() == null }; contents.add(WeakReference(session))
+        }
+        return session
+    }
+    /** Generated Customer capability boundary. Server-only operations cannot be selected. */
+    suspend fun customerOperation(operation: IndianaCustomerOperation, input: JSONObject): JSONObject {
+        checkOpen()
+        val original = identity.get()
+        val token = original.token ?: throw IndianaClientException("unauthenticated")
+        val payload = IndianaCustomerSemantics.defaults(operation.wireName, input)
+        if (payload.has("customerId") || payload.has("customerToken")) throw IndianaClientException("invalid_request")
+        IndianaCustomerSemantics.preflight(operation.wireName, payload)
+        try { IndianaSchema.validate("customer" + operation.wireName + "Request", payload) }
+        catch (_: Exception) { throw IndianaClientException("invalid_request") }
+        IndianaCustomerSemantics.request(operation.wireName, payload)
+        val response = try { http.send(operation.path, operation.method, token, if (operation.method == "GET") null else payload) }
+            catch (error: Exception) { if (identity.get().epoch != original.epoch || closed.get()) throw IndianaClientException("identity_changed"); throw error }
+        if (identity.get().epoch != original.epoch || closed.get()) throw IndianaClientException("identity_changed")
+        if (safe { scope(response.getJSONObject("scope")) } != configuration.scope) throw IndianaClientException("scope_mismatch")
+        IndianaSchema.validate("customer" + operation.wireName + "Response", response)
+        val normalized = try { IndianaSchema.customerResponse("customer" + operation.wireName + "Response", response) } catch (error: IndianaClientException) { throw error } catch (_: Exception) { throw IndianaClientException("invalid_response") }
+        IndianaCustomerSemantics.response(operation.wireName, normalized)
+        if (scope(normalized.getJSONObject("scope")) != configuration.scope) throw IndianaClientException("invalid_response")
+        return JSONObject(normalized.toString())
+    }
+    private fun checkOpen() { if (closed.get()) throw IndianaClientException("closed") }
+    private suspend fun authenticated(path: String, body: JSONObject, credential: String? = null): JSONObject {
+        if (credential == null) IndianaCustomerOperation.entries.firstOrNull { it.path == path }?.let { return customerOperation(it, body) }
+        checkOpen(); val actor = identity.get(); val token = credential ?: actor.token ?: throw IndianaClientException("unauthenticated")
+        if (actor.token == null) throw IndianaClientException("unauthenticated")
+        val response = try { http.send(path, "POST", token, body) } catch (error: Exception) { if (identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed"); throw error }
+        if (identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+        if (safe { scope(response.getJSONObject("scope")) } != configuration.scope) throw IndianaClientException("scope_mismatch")
+        return response
+    }
+    suspend fun readHoldings(): JSONObject = authenticated("customer-holdings", JSONObject())
+    suspend fun checkEntitlement(internalFeatureId: UUID, quantity: String = "1", properties: JSONObject = JSONObject()): JSONObject {
+        val body = JSONObject().put("requirement", JSONObject().put("internal_feature_id", internalFeatureId.toString()).put("quantity", quantity).put("properties", JSONObject(properties.toString())))
+        IndianaSchema.validate("checkRequest", body)
+        val result = authenticated("entitlements/check", body)
+        IndianaSchema.validate("checkResponse", result)
+        return result
+    }
+    /** The authenticated merchant backend selects the Customer and adds its Server Key; retain idempotencyKey on retry. */
+    suspend fun trackUsage(command: JSONObject, relay: suspend (JSONObject) -> JSONObject): JSONObject {
+        checkOpen(); val actor = identity.get(); if (actor.token == null) throw IndianaClientException("unauthenticated")
+        val body = JSONObject(command.toString()); IndianaSchema.validate("usageCommand", body)
+        val result = try { relay(body) } catch (error: Exception) {
+            if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+            throw error
+        }
+        if (identity.get().epoch != actor.epoch || closed.get()) throw IndianaClientException("identity_changed")
+        IndianaSchema.validate("usageResponse", result)
+        if (safe { scope(result.getJSONObject("scope")) } != configuration.scope) throw IndianaClientException("invalid_response")
+        return JSONObject(result.toString())
+    }
+    /** Keep requestId on retry. Channel execution follows server capabilities. */
+    suspend fun previewAttach(requestId: UUID, plans: List<IndianaSubscriptionPlan>, provider: IndianaSubscriptionProvider, currency: String, billingSubscriptionId: UUID? = null, offerId: UUID? = null, nativeOffer: IndianaNativeStoreOffer? = null): JSONObject {
+        if (plans.size !in 1..20 || plans.map { it.productVersionId }.distinct().size != plans.size || !currency.matches(Regex("[A-Z]{3}")) || plans.any { it.featureQuantities.size > 100 || it.featureQuantities.values.any { q -> q !in 0..10000 } || it.seatQuantities.size > 20 || it.seatQuantities.any { (key, quantity) -> !key.matches(Regex("[a-z][a-z0-9_]{0,63}")) || quantity !in 0..10000 } }) throw IndianaClientException("invalid_request")
+        val entries = JSONArray()
+        plans.forEach { entries.put(JSONObject().put("productVersionId", it.productVersionId.toString()).put("seatQuantities", JSONObject(it.seatQuantities)).put("featureQuantities", JSONObject(it.featureQuantities.mapKeys { entry -> entry.key.toString() }))) }
+        val body = JSONObject().put("requestId", requestId.toString()).put("plans", entries).put("provider", provider.value).put("currency", currency)
+        billingSubscriptionId?.let { body.put("billingSubscriptionId", it.toString()) }
+        if (nativeOffer != null && (!nativeOffer.matches(provider) || plans.size != 1) ||
+            offerId != null && (billingSubscriptionId != null || provider != IndianaSubscriptionProvider.STRIPE && nativeOffer == null)) throw IndianaClientException("invalid_request")
+        offerId?.let { body.put("offerId", it.toString()) }
+        nativeOffer?.let { body.put("nativeOffer", it.wire()) }
+        return authenticated("subscriptions/preview-attach", body)
+    }
+    /** Call after the customer accepts the frozen quote. */
+    suspend fun attach(operationId: UUID,intent:String="confirm"): JSONObject { if(intent !in listOf("confirm","cancel")) throw IndianaClientException("invalid_request");return authenticated("subscriptions/attach", JSONObject().put("operationId", operationId.toString()).put("intent",intent)) }
+    suspend fun previewUpdate(requestId: UUID, membershipId: UUID, productVersionId: UUID, timing: String): JSONObject {
+        if (timing !in listOf("immediate", "renewal", "store")) throw IndianaClientException("invalid_request")
+        return authenticated("subscriptions/preview-update", JSONObject().put("requestId", requestId.toString()).put("membershipId", membershipId.toString()).put("timing", timing).put("change", JSONObject().put("type", "plan").put("productVersionId", productVersionId.toString())))
+    }
+    suspend fun previewSeatUpdate(requestId: UUID, membershipId: UUID, licenseKey: String, quantity: Int, timing: String): JSONObject {
+        if (timing !in listOf("immediate", "renewal") || quantity !in 0..10000 || !licenseKey.matches(Regex("[a-z][a-z0-9_]{0,63}"))) throw IndianaClientException("invalid_request")
+        return authenticated("subscriptions/preview-update", JSONObject().put("requestId", requestId.toString()).put("membershipId", membershipId.toString()).put("timing", timing).put("change", JSONObject().put("type", "seats").put("licenseKey", licenseKey).put("quantity", quantity)))
+    }
+    /** Executes according to the held plan's billing channel; Play plans require store support. */
+    suspend fun previewQuantityUpdate(requestId: UUID, membershipId: UUID, internal_feature_id: UUID, quantity: Int, timing: String): JSONObject {
+        if (timing !in listOf("immediate", "renewal") || quantity !in 0..10000) throw IndianaClientException("invalid_request")
+        return authenticated("subscriptions/preview-update", JSONObject().put("requestId", requestId.toString()).put("membershipId", membershipId.toString()).put("timing", timing).put("change", JSONObject().put("type", "quantity").put("internal_feature_id", internal_feature_id.toString()).put("quantity", quantity)))
+    }
+    suspend fun previewCancellation(requestId: UUID, membershipId: UUID, timing: String): JSONObject {
+        if (timing !in listOf("immediate", "renewal")) throw IndianaClientException("invalid_request")
+        return authenticated("subscriptions/preview-update", JSONObject().put("requestId", requestId.toString()).put("membershipId", membershipId.toString()).put("timing", timing).put("change", JSONObject().put("type", "cancel")))
+    }
+    suspend fun previewUncancel(requestId: UUID, membershipId: UUID): JSONObject = authenticated("subscriptions/preview-update", JSONObject().put("requestId", requestId.toString()).put("membershipId", membershipId.toString()).put("timing", "immediate").put("change", JSONObject().put("type", "uncancel")))
+    suspend fun update(operationId: UUID,intent:String="confirm"): JSONObject { if(intent !in listOf("confirm","cancel")) throw IndianaClientException("invalid_request");return authenticated("subscriptions/update", JSONObject().put("operationId", operationId.toString()).put("intent",intent)) }
+    suspend fun readSubscriptionUpdate(operationId: UUID): JSONObject = authenticated("subscriptions/updates/read", JSONObject().put("operationId", operationId.toString()))
+    suspend fun readSubscriptionOperation(operationId: UUID): JSONObject = authenticated("subscriptions/operations/read", JSONObject().put("operationId", operationId.toString()))
+    suspend fun readLedger(query: JSONObject): JSONObject = customerOperation(IndianaCustomerOperation.readLedger, JSONObject().put("query", JSONObject(query.toString())))
+    suspend fun quoteBalance(internal_feature_id: UUID, quantity: String, properties: JSONObject = JSONObject()): JSONObject = authenticated("balances/quote", JSONObject().put("command", JSONObject().put("operation", "quote").put("internal_feature_id", internal_feature_id.toString()).put("quantity", quantity).put("properties", JSONObject(properties.toString()))))
+    /** Enables the Push capability of this client. The App owns OS permission prompts. */
+    fun enablePush() = synchronized(identityLock) {
+        checkOpen(); if (pushIdentity != null) return@synchronized
+        val installation = IndianaPushIdentity(pushStorage?.invoke() ?: throw IndianaClientException("invalid_configuration"))
+        if (identity.get().token != null) pushBindingSequence = installation.reserve()
+        pushIdentity = installation; schedulePush()
+    }
+    private fun schedulePush() {
+        if (pushIdentity == null || pushSynchronizationError == "protected_storage_unavailable" || closed.get()) return
+        val original = identity.get().epoch
+        pushScope.launch {
+            try { syncPush() } catch (error: Exception) {
+                synchronized(identityLock) { if (identity.get().epoch == original) pushSynchronizationError = (error as? IndianaClientException)?.code ?: "temporary_unavailable" }
+            }
+        }
+    }
+    suspend fun syncPush(): JSONObject? = pushSyncLock.withLock {
+        val (installation, actor, binding) = synchronized(identityLock) {
+            checkOpen(); if (pushSynchronizationError == "protected_storage_unavailable") throw IndianaClientException("protected_storage_unavailable")
+            Triple(pushIdentity ?: throw IndianaClientException("invalid_configuration"), identity.get(), pushBindingSequence)
+        }
+        val state = installation.state()
+        var missingDetach = false
+        state.detachSeq?.let { sequence ->
+            val command = installation.command("detach", configuration.scope, sequence)
+            try {
+                val acknowledged = validatePush(http.send("push/installations/detach", "POST", "", command), state.installationId)
+                if (acknowledged.getBoolean("bound") || acknowledged.getLong("identitySeq") != sequence) throw IndianaClientException("invalid_response")
+            }
+            catch (error: IndianaClientException) { if (error.code == "request_failed_404") missingDetach = true else if (error.code != "request_failed_412") throw error }
+            if (!missingDetach) installation.clearDetach(sequence)
+        }
+        checkPushEpoch(actor.epoch)
+        if (actor.token == null && missingDetach) throw IndianaClientException("request_failed_404")
+        val response = actor.token?.let { token ->
+            val proofCredential = http.access(); checkPushEpoch(actor.epoch)
+            val command = installation.command("bind", configuration.scope, binding, proofCredential)
+            checkPushEpoch(actor.epoch)
+            validatePush(authenticated("push/installations/bind", command, proofCredential), state.installationId).also {
+                if (!it.getBoolean("bound") || it.getLong("identitySeq") != binding) throw IndianaClientException("invalid_response")
+            }
+        }
+        if (missingDetach && state.detachSeq != null && binding > state.detachSeq) installation.clearDetach(state.detachSeq)
+        synchronized(identityLock) { checkPushEpoch(actor.epoch); pushSynchronizationError = null }
+        response
+    }
+    suspend fun readPushInstallation(): JSONObject {
+        val (installation, actor) = synchronized(identityLock) { checkOpen(); (pushIdentity ?: throw IndianaClientException("invalid_configuration")) to identity.get() }
+        val proofCredential = http.access(); checkPushEpoch(actor.epoch)
+        val command = installation.command("read", configuration.scope, credential = proofCredential)
+        checkPushEpoch(actor.epoch)
+        return validatePush(authenticated("push/installations/read", command, proofCredential), installation.state().installationId).also { checkPushEpoch(actor.epoch) }
+    }
+    fun capturePushObservation(): IndianaPushObservationTicket = synchronized(identityLock) {
+        checkOpen(); if (pushIdentity == null) throw IndianaClientException("invalid_configuration")
+        pushObservationID = UUID.randomUUID(); IndianaPushObservationTicket(pushClientID, identity.get().epoch, pushObservationID)
+    }
+    suspend fun recoverPushCounters(): JSONObject? {
+        val (installation, actor, expected) = synchronized(identityLock) {
+            checkOpen(); pushObservationID = UUID.randomUUID()
+            Triple(pushIdentity ?: throw IndianaClientException("invalid_configuration"), identity.get(), pushBindingSequence)
+        }
+        val remote = readPushInstallation()
+        synchronized(identityLock) { checkPushEpoch(actor.epoch); pushBindingSequence = installation.recover(remote, expected) }
+        return syncPush()
+    }
+    suspend fun observePush(observation: IndianaPushObservation, ticket: IndianaPushObservationTicket): JSONObject? {
+        fun current() = ticket.client == pushClientID && ticket.identity == identity.get().epoch && ticket.observation == pushObservationID
+        if (!synchronized(identityLock) { checkOpen(); current() }) return null
+        syncPush()
+        val proofCredential = http.access(); checkPushEpoch(ticket.identity)
+        val command = synchronized(identityLock) {
+            if (!current()) return null
+            val installation = pushIdentity ?: throw IndianaClientException("invalid_configuration")
+            installation.command("address", configuration.scope, installation.reserveAddress(), proofCredential, observation)
+        }
+        checkPushEpoch(ticket.identity)
+        val response = authenticated("push/installations/address", command, proofCredential)
+        checkPushEpoch(ticket.identity)
+        return validatePush(response, UUID.fromString(command.getString("installationId")))
+    }
+    /** Requests a security notification; the challenge arrives through the native FCM callback. */
+    suspend fun requestPushAddressRecovery(observation: IndianaPushObservation, ticket: IndianaPushObservationTicket): JSONObject {
+        recoveryPushIdentity(observation, ticket)
+        syncPush()
+        val proofCredential = http.access(); checkPushEpoch(ticket.identity)
+        val command = synchronized(identityLock) {
+            val (installation, token) = recoveryPushIdentity(observation, ticket)
+            installation.command("recovery_request", configuration.scope, installation.reserveAddress(), proofCredential, observation)
+        }
+        val response = authenticated("push/installations/recovery/request", command, proofCredential)
+        return synchronized(identityLock) {
+            recoveryPushIdentity(observation, ticket)
+            safe {
+                if (scope(response.getJSONObject("scope")) != configuration.scope) throw IndianaClientException("invalid_response")
+                val recovery = response.getJSONObject("recovery")
+                keys(recovery, setOf("requested", "expiresAt"))
+                if (recovery.opt("requested") != true) throw IndianaClientException("invalid_response")
+                utcMillis(text(recovery, "expiresAt"))
+                JSONObject(recovery.toString())
+            }
+        }
+    }
+    /** Reacquire the current FCM token under a fresh ticket before confirming a native challenge. */
+    suspend fun confirmPushAddressRecovery(challenge: String, observation: IndianaPushObservation, ticket: IndianaPushObservationTicket): JSONObject {
+        val proofCredential = http.access(); checkPushEpoch(ticket.identity)
+        val command = synchronized(identityLock) {
+            val (installation, token) = recoveryPushIdentity(observation, ticket)
+            val state = installation.state()
+            if (state.addressSeq == 0L) throw IndianaClientException("invalid_configuration")
+            installation.command("recovery_confirm", configuration.scope, state.addressSeq, proofCredential, observation, challenge)
+        }
+        val response = authenticated("push/installations/recovery/confirm", command, proofCredential)
+        return synchronized(identityLock) {
+            val (installation, _) = recoveryPushIdentity(observation, ticket)
+            if (installation.state().addressSeq != command.getLong("sequence")) throw IndianaClientException("identity_changed")
+            val state = validatePush(response, UUID.fromString(command.getString("installationId")))
+            if (!state.getBoolean("bound") || state.getLong("identitySeq") != pushBindingSequence || state.getLong("addressSeq") != command.getLong("sequence") ||
+                state.optString("connectionId") != observation.connectionId.toString() || state.optString("addressStatus") != "active") throw IndianaClientException("invalid_response")
+            state
+        }
+    }
+    private fun recoveryPushIdentity(observation: IndianaPushObservation, ticket: IndianaPushObservationTicket): Pair<IndianaPushIdentity, String> = synchronized(identityLock) {
+        checkOpen()
+        if (ticket.client != pushClientID || ticket.identity != identity.get().epoch || ticket.observation != pushObservationID) throw IndianaClientException("identity_changed")
+        val installation = pushIdentity ?: throw IndianaClientException("invalid_configuration")
+        val token = identity.get().token ?: throw IndianaClientException("unauthenticated")
+        if (observation.connectionId == null || observation.kind != IndianaPushAddressKind.FCM_TOKEN || observation.token == null ||
+            observation.permission !in setOf(IndianaPushPermission.GRANTED, IndianaPushPermission.PROVISIONAL)) throw IndianaClientException("invalid_configuration")
+        installation to token
+    }
+    suspend fun readPushPreference(): JSONObject = authenticated("messaging/preferences/read", JSONObject().put("channel", "push"))
+    suspend fun setPushPreference(allowed: Boolean, revision: Long): JSONObject {
+        if (revision !in 0 until PUSH_MAX_SEQUENCE) throw IndianaClientException("invalid_request")
+        return authenticated("messaging/preferences/set", JSONObject().put("requestId", UUID.randomUUID().toString()).put("channel", "push").put("state", if (allowed) "allowed" else "denied").put("expectedRevision", revision))
+    }
+    private fun checkPushEpoch(original: UUID) { if (closed.get() || identity.get().epoch != original) throw IndianaClientException("identity_changed") }
+    private fun validatePush(response: JSONObject, installation: UUID): JSONObject = safe {
+        if (scope(response.getJSONObject("scope")) != configuration.scope) throw IndianaClientException("invalid_response")
+        val state = response.getJSONObject("installation")
+        if (UUID.fromString(state.getString("installationId")) != installation || state.opt("bound") !is Boolean || state.getLong("identitySeq") !in 1..PUSH_MAX_SEQUENCE || state.getLong("bindingGeneration") !in 1..PUSH_MAX_SEQUENCE || state.getLong("addressSeq") !in 0..PUSH_MAX_SEQUENCE || state.getLong("addressRevision") !in 0..PUSH_MAX_SEQUENCE || state.getString("permission") !in IndianaPushPermission.entries.map { it.value } || (!state.isNull("addressStatus") && state.getString("addressStatus") !in setOf("active", "invalid"))) throw IndianaClientException("invalid_response")
+        if (!state.isNull("connectionId")) UUID.fromString(state.getString("connectionId"))
+        JSONObject(state.toString())
+    }
+    override fun close() { if (closed.compareAndSet(false, true)) { reset(); pushScope.cancel() } }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/NativePendingKeystore.kt

@@ -0,0 +1,81 @@
+package ai.tinkerland.indiana
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.AtomicFile
+import android.util.Base64
+import org.json.JSONObject
+import java.io.File
+import java.security.KeyStore
+import java.security.MessageDigest
+import java.util.UUID
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+internal data class IndianaNativePendingOrder(val runId: UUID, val orderId: UUID, val receiptId: UUID, val productId: String, val accountId: String, val profileId: String, val basePlanId: String?, val offerId: String?) {
+    fun json(): JSONObject = JSONObject().put("runId", runId.toString()).put("orderId", orderId.toString()).put("receiptId", receiptId.toString()).put("productId", productId).put("obfuscatedAccountId", accountId).put("obfuscatedProfileId", profileId).put("basePlanId", basePlanId ?: JSONObject.NULL).put("offerId", offerId ?: JSONObject.NULL)
+    companion object {
+        fun parse(value: JSONObject, runId: UUID = UUID.fromString(value.getString("runId"))): IndianaNativePendingOrder {
+            val result = IndianaNativePendingOrder(runId, UUID.fromString(value.getString("orderId")), UUID.fromString(value.getString("receiptId")), value.getString("productId"), value.getString("obfuscatedAccountId"), value.getString("obfuscatedProfileId"), value.optString("basePlanId").takeIf { value.has("basePlanId") && !value.isNull("basePlanId") }, value.optString("offerId").takeIf { value.has("offerId") && !value.isNull("offerId") })
+            if (result.productId.length !in 1..255 || result.accountId.length !in 1..64 || result.profileId.length !in 1..64) throw IndianaClientException("invalid_response")
+            return result
+        }
+    }
+}
+/** Current order metadata only. No token/JWS/customer credential or legacy storage is read. */
+internal interface IndianaNativePendingStorage {
+    fun read(order: UUID): IndianaNativePendingOrder?
+    fun orders(): List<IndianaNativePendingOrder>
+    fun remove(order: UUID)
+}
+internal class IndianaNativePendingKeystore(context: Context, scope: IndianaScope): IndianaNativePendingStorage {
+    private val namespace = "${context.packageName}:${scope.projectId}:${scope.environment.value}"
+    private val hash = MessageDigest.getInstance("SHA-256").digest(namespace.toByteArray()).joinToString("") { "%02x".format(it) }
+    private val directory = File(context.noBackupFilesDir, "grow-funnel-orders-$hash")
+    private val alias = "grow.funnel.orders.v1.$hash"
+    companion object { private val lock = Any() }
+    private fun file(order: UUID) = AtomicFile(File(directory, "$order.json"))
+    private fun aad(order: UUID) = "grow_funnel_order_v1\u0000$namespace\u0000$order".toByteArray()
+    private fun key(create: Boolean): SecretKey {
+        val store = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+        (store.getKey(alias, null) as? SecretKey)?.let { return it }
+        if (!create || directory.listFiles()?.any { it.isFile } == true) throw IndianaClientException("protected_storage_unavailable")
+        val spec = KeyGenParameterSpec.Builder(alias, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT).setKeySize(256).setBlockModes(KeyProperties.BLOCK_MODE_GCM).setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE).setRandomizedEncryptionRequired(true).build()
+        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore").apply { init(spec) }.generateKey()
+    }
+    override fun read(order: UUID): IndianaNativePendingOrder? = synchronized(lock) {
+        try {
+            if (!file(order).baseFile.exists()) return@synchronized null
+            val bytes = file(order).openRead().use { input -> val output = java.io.ByteArrayOutputStream(); val buffer = ByteArray(1024); while (true) { val count = input.read(buffer); if (count < 0) break; if (output.size() + count > 8192) throw IndianaClientException("protected_storage_unavailable"); output.write(buffer, 0, count) }; output.toByteArray() }
+            val value = JSONObject(bytes.toString(Charsets.UTF_8)); if (value.keys().asSequence().toSet() != setOf("format", "nonce", "ciphertext") || value.getString("format") != "grow_funnel_order_v1") throw IndianaClientException("protected_storage_unavailable")
+            val nonce = Base64.decode(value.getString("nonce"), Base64.NO_WRAP); if (nonce.size != 12) throw IndianaClientException("protected_storage_unavailable")
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding"); cipher.init(Cipher.DECRYPT_MODE, key(false), GCMParameterSpec(128, nonce)); cipher.updateAAD(aad(order))
+            val plaintext = cipher.doFinal(Base64.decode(value.getString("ciphertext"), Base64.NO_WRAP))
+            try { IndianaNativePendingOrder.parse(JSONObject(plaintext.toString(Charsets.UTF_8))).also { if (it.orderId != order) throw IndianaClientException("protected_storage_unavailable") } } finally { plaintext.fill(0) }
+        } catch (_: Exception) { throw IndianaClientException("protected_storage_unavailable") }
+    }
+    override fun orders(): List<IndianaNativePendingOrder> = synchronized(lock) {
+        val files = directory.listFiles()?.filter { it.name.endsWith(".json") } ?: emptyList()
+        if (files.size > 100) throw IndianaClientException("protected_storage_unavailable")
+        files.mapNotNull { read(UUID.fromString(it.name.removeSuffix(".json"))) }
+    }
+    fun orders(runId: UUID): List<IndianaNativePendingOrder> = orders().filter { it.runId == runId }
+    fun contains(record: IndianaNativePendingOrder): Boolean { val previous = read(record.orderId) ?: return false; if (previous != record) throw IndianaClientException("protected_storage_unavailable"); return true }
+    fun put(record: IndianaNativePendingOrder) = synchronized(lock) {
+        if (contains(record)) return@synchronized
+        if ((directory.listFiles()?.count { it.name.endsWith(".json") } ?: 0) >= 100) throw IndianaClientException("protected_storage_unavailable")
+        val currentKey = key(true)
+        if (!directory.exists() && !directory.mkdirs()) throw IndianaClientException("protected_storage_unavailable")
+        val plaintext = record.json().toString().toByteArray()
+        try {
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding"); cipher.init(Cipher.ENCRYPT_MODE, currentKey); cipher.updateAAD(aad(record.orderId))
+            val bytes = JSONObject().put("format", "grow_funnel_order_v1").put("nonce", Base64.encodeToString(cipher.iv, Base64.NO_WRAP)).put("ciphertext", Base64.encodeToString(cipher.doFinal(plaintext), Base64.NO_WRAP)).toString().toByteArray()
+            val atomic = file(record.orderId); val stream = atomic.startWrite()
+            try { stream.write(bytes); atomic.finishWrite(stream) } catch (error: Exception) { atomic.failWrite(stream); throw error }
+        } finally { plaintext.fill(0) }
+    }
+    override fun remove(order: UUID) = synchronized(lock) { file(order).delete() }
+}