@tinkerlandai/indiana-react-native 0.9.2 → 0.10.1

package/native-sdk/android/java/ai/tinkerland/indiana/NativePendingKeystore.kt

@@ -0,0 +1,81 @@
+package ai.tinkerland.indiana
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.AtomicFile
+import android.util.Base64
+import org.json.JSONObject
+import java.io.File
+import java.security.KeyStore
+import java.security.MessageDigest
+import java.util.UUID
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+internal data class IndianaNativePendingOrder(val runId: UUID, val orderId: UUID, val receiptId: UUID, val productId: String, val accountId: String, val profileId: String, val basePlanId: String?, val offerId: String?) {
+    fun json(): JSONObject = JSONObject().put("runId", runId.toString()).put("orderId", orderId.toString()).put("receiptId", receiptId.toString()).put("productId", productId).put("obfuscatedAccountId", accountId).put("obfuscatedProfileId", profileId).put("basePlanId", basePlanId ?: JSONObject.NULL).put("offerId", offerId ?: JSONObject.NULL)
+    companion object {
+        fun parse(value: JSONObject, runId: UUID = UUID.fromString(value.getString("runId"))): IndianaNativePendingOrder {
+            val result = IndianaNativePendingOrder(runId, UUID.fromString(value.getString("orderId")), UUID.fromString(value.getString("receiptId")), value.getString("productId"), value.getString("obfuscatedAccountId"), value.getString("obfuscatedProfileId"), value.optString("basePlanId").takeIf { value.has("basePlanId") && !value.isNull("basePlanId") }, value.optString("offerId").takeIf { value.has("offerId") && !value.isNull("offerId") })
+            if (result.productId.length !in 1..255 || result.accountId.length !in 1..64 || result.profileId.length !in 1..64) throw IndianaClientException("invalid_response")
+            return result
+        }
+    }
+}
+/** Current order metadata only. No token/JWS/customer credential or legacy storage is read. */
+internal interface IndianaNativePendingStorage {
+    fun read(order: UUID): IndianaNativePendingOrder?
+    fun orders(): List<IndianaNativePendingOrder>
+    fun remove(order: UUID)
+}
+internal class IndianaNativePendingKeystore(context: Context, scope: IndianaScope): IndianaNativePendingStorage {
+    private val namespace = "${context.packageName}:${scope.projectId}:${scope.environment.value}"
+    private val hash = MessageDigest.getInstance("SHA-256").digest(namespace.toByteArray()).joinToString("") { "%02x".format(it) }
+    private val directory = File(context.noBackupFilesDir, "grow-funnel-orders-$hash")
+    private val alias = "grow.funnel.orders.v1.$hash"
+    companion object { private val lock = Any() }
+    private fun file(order: UUID) = AtomicFile(File(directory, "$order.json"))
+    private fun aad(order: UUID) = "grow_funnel_order_v1\u0000$namespace\u0000$order".toByteArray()
+    private fun key(create: Boolean): SecretKey {
+        val store = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+        (store.getKey(alias, null) as? SecretKey)?.let { return it }
+        if (!create || directory.listFiles()?.any { it.isFile } == true) throw IndianaClientException("protected_storage_unavailable")
+        val spec = KeyGenParameterSpec.Builder(alias, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT).setKeySize(256).setBlockModes(KeyProperties.BLOCK_MODE_GCM).setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE).setRandomizedEncryptionRequired(true).build()
+        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore").apply { init(spec) }.generateKey()
+    }
+    override fun read(order: UUID): IndianaNativePendingOrder? = synchronized(lock) {
+        try {
+            if (!file(order).baseFile.exists()) return@synchronized null
+            val bytes = file(order).openRead().use { input -> val output = java.io.ByteArrayOutputStream(); val buffer = ByteArray(1024); while (true) { val count = input.read(buffer); if (count < 0) break; if (output.size() + count > 8192) throw IndianaClientException("protected_storage_unavailable"); output.write(buffer, 0, count) }; output.toByteArray() }
+            val value = JSONObject(bytes.toString(Charsets.UTF_8)); if (value.keys().asSequence().toSet() != setOf("format", "nonce", "ciphertext") || value.getString("format") != "grow_funnel_order_v1") throw IndianaClientException("protected_storage_unavailable")
+            val nonce = Base64.decode(value.getString("nonce"), Base64.NO_WRAP); if (nonce.size != 12) throw IndianaClientException("protected_storage_unavailable")
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding"); cipher.init(Cipher.DECRYPT_MODE, key(false), GCMParameterSpec(128, nonce)); cipher.updateAAD(aad(order))
+            val plaintext = cipher.doFinal(Base64.decode(value.getString("ciphertext"), Base64.NO_WRAP))
+            try { IndianaNativePendingOrder.parse(JSONObject(plaintext.toString(Charsets.UTF_8))).also { if (it.orderId != order) throw IndianaClientException("protected_storage_unavailable") } } finally { plaintext.fill(0) }
+        } catch (_: Exception) { throw IndianaClientException("protected_storage_unavailable") }
+    }
+    override fun orders(): List<IndianaNativePendingOrder> = synchronized(lock) {
+        val files = directory.listFiles()?.filter { it.name.endsWith(".json") } ?: emptyList()
+        if (files.size > 100) throw IndianaClientException("protected_storage_unavailable")
+        files.mapNotNull { read(UUID.fromString(it.name.removeSuffix(".json"))) }
+    }
+    fun orders(runId: UUID): List<IndianaNativePendingOrder> = orders().filter { it.runId == runId }
+    fun contains(record: IndianaNativePendingOrder): Boolean { val previous = read(record.orderId) ?: return false; if (previous != record) throw IndianaClientException("protected_storage_unavailable"); return true }
+    fun put(record: IndianaNativePendingOrder) = synchronized(lock) {
+        if (contains(record)) return@synchronized
+        if ((directory.listFiles()?.count { it.name.endsWith(".json") } ?: 0) >= 100) throw IndianaClientException("protected_storage_unavailable")
+        val currentKey = key(true)
+        if (!directory.exists() && !directory.mkdirs()) throw IndianaClientException("protected_storage_unavailable")
+        val plaintext = record.json().toString().toByteArray()
+        try {
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding"); cipher.init(Cipher.ENCRYPT_MODE, currentKey); cipher.updateAAD(aad(record.orderId))
+            val bytes = JSONObject().put("format", "grow_funnel_order_v1").put("nonce", Base64.encodeToString(cipher.iv, Base64.NO_WRAP)).put("ciphertext", Base64.encodeToString(cipher.doFinal(plaintext), Base64.NO_WRAP)).toString().toByteArray()
+            val atomic = file(record.orderId); val stream = atomic.startWrite()
+            try { stream.write(bytes); atomic.finishWrite(stream) } catch (error: Exception) { atomic.failWrite(stream); throw error }
+        } finally { plaintext.fill(0) }
+    }
+    override fun remove(order: UUID) = synchronized(lock) { file(order).delete() }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/NativeReceiptRelay.kt

@@ -0,0 +1,28 @@
+package ai.tinkerland.indiana
+
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+import java.net.URI
+import java.net.HttpURLConnection
+import java.io.ByteArrayOutputStream
+
+/** The endpoint is your trusted app backend. No Indiana server API key belongs on the device. */
+class IndianaNativeReceiptRelay(endpoint: String) {
+    private val url = URI(endpoint).also { require(it.scheme == "https" && it.host != null && it.rawUserInfo == null && it.rawQuery == null && it.rawFragment == null) }.toURL()
+    suspend fun send(body: JSONObject): JSONObject = withContext(Dispatchers.IO) {
+        val token = body.opt("customerToken") as? String ?: throw IndianaClientException("unauthenticated")
+        val bytes = body.toString().toByteArray(Charsets.UTF_8)
+        if (body.optString("operation") != "native_receipt" || !token.matches(Regex("gg_ct_[A-Za-z0-9_-]{32,128}")) || bytes.size > 262144) throw IndianaClientException("invalid_command")
+        val connection = url.openConnection() as HttpURLConnection
+        try {
+            connection.requestMethod = "POST"; connection.instanceFollowRedirects = false; connection.useCaches = false; connection.connectTimeout = 35000; connection.readTimeout = 35000
+            connection.setRequestProperty("Content-Type", "application/json"); connection.setRequestProperty("Authorization", "Bearer $token")
+            connection.doOutput = true; connection.setFixedLengthStreamingMode(bytes.size); connection.outputStream.use { it.write(bytes) }
+            if (connection.responseCode !in 200..299) throw IndianaClientException("request_failed_${connection.responseCode}")
+            if ((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0) > 262144) throw IndianaClientException("invalid_response")
+            val output = ByteArrayOutputStream(); connection.inputStream.use { input -> val buffer = ByteArray(8192); while (true) { val count = input.read(buffer); if (count < 0) break; if (output.size() + count > 262144) throw IndianaClientException("invalid_response"); output.write(buffer,0,count) } }
+            safe { JSONObject(output.toString("UTF-8")) }
+        } catch (error: IndianaClientException) { throw error } catch (_: Exception) { throw IndianaClientException("temporary_unavailable") } finally { connection.disconnect() }
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/NativeStoreOffer.kt

@@ -0,0 +1,24 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+
+enum class IndianaNativeOfferKind(val value: String) { NONE("none"), INTRODUCTORY("introductory"), PROMOTIONAL("promotional") }
+
+/** Selected store terms are input evidence until the backend verifies the transaction. */
+data class IndianaNativeStoreOffer(val offerKind: IndianaNativeOfferKind, val offerId: String? = null, val discountMinor: Long = 0, val trialDays: Int? = null) {
+    init {
+        require(discountMinor in 0..100000000)
+        require(trialDays == null || trialDays in 1..730)
+        require(offerId == null || offerId.matches(Regex("[A-Za-z0-9][A-Za-z0-9._-]{0,254}")))
+        require(trialDays == null || discountMinor == 0L)
+        require(offerKind != IndianaNativeOfferKind.NONE || (offerId == null && discountMinor == 0L && trialDays == null))
+    }
+    internal fun wire(): JSONObject = JSONObject().put("offerKind", offerKind.value).put("offerId", offerId ?: JSONObject.NULL)
+        .put("discountMinor", discountMinor).put("trialDays", trialDays ?: JSONObject.NULL)
+    internal fun matches(provider: IndianaSubscriptionProvider): Boolean = when (provider) {
+        IndianaSubscriptionProvider.STRIPE, IndianaSubscriptionProvider.MERCHANT -> false
+        IndianaSubscriptionProvider.APPLE -> (offerKind == IndianaNativeOfferKind.PROMOTIONAL) == (offerId != null)
+        IndianaSubscriptionProvider.GOOGLE -> (offerKind == IndianaNativeOfferKind.NONE) == (offerId == null) &&
+            (offerId == null || offerId.matches(Regex("[a-z0-9][a-z0-9-]*")))
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallContent.kt

@@ -0,0 +1,75 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+import java.security.MessageDigest
+
+/** Public immutable JSON only; the API's authenticated reply pins these exact bytes. */
+internal class IndianaPaywallContent(configuration: IndianaConfiguration) {
+    private val relay = IndianaFunnelConfigurationRelay(configuration)
+    suspend fun resolve(delivery: JSONObject): JSONObject {
+        IndianaSchema.validate("paywallDelivery", delivery)
+        val content = delivery.getJSONObject("content")
+        val artifact = content.getJSONObject("artifact")
+        val digest = artifact.getString("sha256")
+        val path = artifact.getString("url")
+        if (artifact.getString("kind") != "paywall" || artifact.getInt("formatVersion") != 1) throw IndianaClientException("invalid_response")
+        if (path != "/api/v1/configuration/${content.getString("environmentId")}/artifacts/$digest") throw IndianaClientException("invalid_response")
+        val reply = relay.read(JSONObject().put("path", path))
+        val bytes = reply.getString("body").toByteArray(Charsets.UTF_8)
+        if (reply.getInt("status") != 200 || !reply.getJSONObject("headers").optString("content-type").lowercase().startsWith("application/json")) throw IndianaClientException("invalid_response")
+        return hydrate(delivery, bytes)
+    }
+    companion object {
+        private val presentationFields = listOf("amountMinor", "interval", "intervalCount", "prepaid")
+        fun validatesHydration(loaded: JSONObject, delivery: JSONObject): Boolean {
+            val protected = JSONObject(loaded.toString()).apply { remove("document"); remove("offering") }
+            val plans = protected.getJSONObject("capabilities").getJSONObject("plans")
+            val original = delivery.getJSONObject("capabilities").getJSONObject("plans")
+            for (id in plans.keys()) {
+                val plan = plans.getJSONObject(id)
+                for (key in presentationFields) if (original.optJSONObject(id)?.has(key) != true) plan.remove(key)
+            }
+            return IndianaSchema.equal(protected, delivery)
+        }
+        fun applyPresentation(loaded: JSONObject, latest: JSONObject) {
+            latest.put("document", loaded.getJSONObject("document")).put("offering", loaded.getJSONObject("offering"))
+            val plans = latest.getJSONObject("capabilities").getJSONObject("plans")
+            val hydrated = loaded.getJSONObject("capabilities").getJSONObject("plans")
+            for (id in plans.keys()) {
+                val plan = plans.getJSONObject(id); val source = hydrated.optJSONObject(id) ?: continue
+                if (source.optString("currency") != plan.optString("currency")) continue
+                for (key in presentationFields) if (source.has(key)) plan.put(key, source.get(key))
+            }
+        }
+        fun hydrate(delivery: JSONObject, bytes: ByteArray): JSONObject {
+            IndianaSchema.validate("paywallDelivery", delivery)
+            val content = delivery.getJSONObject("content"); val artifact = content.getJSONObject("artifact")
+            val digest = artifact.getString("sha256")
+            if (artifact.getString("kind") != "paywall" || artifact.getInt("formatVersion") != 1) throw IndianaClientException("invalid_response")
+            val actual = MessageDigest.getInstance("SHA-256").digest(bytes).joinToString("") { "%02x".format(it) }
+            if (bytes.size != artifact.getInt("byteLength") || actual != digest) throw IndianaClientException("invalid_response")
+            val text = try { Charsets.UTF_8.newDecoder().onMalformedInput(java.nio.charset.CodingErrorAction.REPORT).decode(java.nio.ByteBuffer.wrap(bytes)).toString() }
+                catch (_: Exception) { throw IndianaClientException("invalid_response") }
+            val file = JSONObject(text); IndianaSchema.validate("publicPaywall", file)
+            if (file.getString("offeringVersionId") != content.getString("offeringVersionId")) throw IndianaClientException("invalid_response")
+            val document = JSONObject().put("schemaVersion", 3)
+            for (key in listOf("kind", "name", "presentation", "products", "offeringVersionId", "screen", "buttons")) document.put(key, file.get(key))
+            val result = JSONObject(delivery.toString()).put("document", document).put("offering", JSONObject().put("id", file.getString("offeringVersionId")))
+            val plans = result.getJSONObject("capabilities").getJSONObject("plans")
+            val catalog = file.getJSONObject("catalog")
+            for (id in catalog.keys()) {
+                val plan = plans.optJSONObject(id) ?: continue
+                val product = catalog.getJSONObject(id)
+                val prices = product.getJSONObject("channels").optJSONObject("stripe")?.optJSONArray("prices") ?: continue
+                for (index in 0 until prices.length()) {
+                    val price = prices.getJSONObject(index)
+                    if (price.getString("currency") != plan.optString("currency")) continue
+                    plan.put("amountMinor", price.get("amountMinor")).put("interval", product.get("interval")).put("intervalCount", product.get("intervalCount"))
+                    if (product.has("prepaid")) plan.put("prepaid", product.getJSONArray("prepaid"))
+                }
+            }
+            IndianaSchema.validate("paywallResolution", result)
+            return result
+        }
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallSession.kt

@@ -0,0 +1,144 @@
+package ai.tinkerland.indiana
+
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import org.json.JSONObject
+import org.json.JSONArray
+import java.net.URI
+import java.util.UUID
+import java.util.concurrent.atomic.AtomicReference
+
+/** Independent Paywall session; credentials and commercial authority stay in native/API code. */
+class IndianaPaywallSession internal constructor(
+    private val configuration: IndianaConfiguration, private val http: IndianaHTTP, customerToken: String,
+    paywallId: UUID?, versionId: UUID?, private val provider: IndianaSubscriptionProvider,
+    private val currency: String, private val locale: String,
+    private val content: suspend (JSONObject) -> JSONObject = IndianaPaywallContent(configuration)::resolve
+) {
+    private val token = AtomicReference<String?>(customerToken)
+    private val view = AtomicReference<JSONObject?>(null)
+    private val quoted = AtomicReference<JSONObject?>(null)
+    private val purchased = AtomicReference<JSONObject?>(null)
+    private val mutex = Mutex()
+    private var pendingPreview: String? = null
+    @Volatile private var invalidation: (() -> Unit)? = null
+    private val selector: JSONObject
+    init {
+        require((paywallId == null) != (versionId == null) && locale.length in 1..35 && currency.matches(Regex("[A-Z]{3}")))
+        selector = if (paywallId != null) JSONObject().put("type", "paywall").put("paywallId", paywallId.toString())
+        else JSONObject().put("type", "version").put("versionId", versionId.toString())
+    }
+    val current: JSONObject? get() = view.get()?.let { JSONObject(it.toString()) }
+    fun close() { token.set(null); view.set(null); quoted.set(null); purchased.set(null); invalidation?.invoke(); invalidation = null }
+    internal fun onInvalidation(callback: () -> Unit) { invalidation = callback; if (token.get() == null) callback() }
+    internal fun hostConfiguration() = configuration
+    internal fun hostInit() = JSONObject().put("event", "init").put("surface", "paywall")
+        .put("scope", JSONObject().put("projectId", configuration.scope.projectId.toString()).put("environment", configuration.scope.environment.value))
+        .put("apiOrigin", configuration.apiOrigin)
+    private suspend fun send(name: String, path: String, body: JSONObject): JSONObject {
+        val original = token.get() ?: throw IndianaClientException("identity_changed")
+        IndianaSchema.validate(name + "Request", body)
+        val result = try { http.send(path, "POST", original, body) } catch (e: Exception) {
+            if (token.get() != original) throw IndianaClientException("identity_changed"); throw e
+        }
+        if (token.get() != original) throw IndianaClientException("identity_changed")
+        IndianaSchema.validate(name + "Response", result)
+        if (safe { scope(result.getJSONObject("scope")) } != configuration.scope) throw IndianaClientException("scope_mismatch")
+        if (name == "resolvePaywall") {
+            result.put("paywall", content(result.getJSONObject("paywall")))
+            if (token.get() != original) throw IndianaClientException("identity_changed")
+        }
+        return result
+    }
+    suspend fun refresh(): JSONObject = hostCommand(JSONObject().put("operation", "resolve").put("input", JSONObject()))
+    internal suspend fun hostCommand(payload: JSONObject): JSONObject = mutex.withLock {
+        if (token.get() == null || payload.keys().asSequence().toSet() != setOf("operation", "input")) throw IndianaClientException("invalid_command")
+        val input = payload.getJSONObject("input")
+        when (val action = payload.getString("operation")) {
+            "resolve" -> {
+                if (input.length() != 0) throw IndianaClientException("invalid_command")
+                val prior = view.get()
+                val selected = prior?.let { JSONObject().put("type", "version").put("versionId", it.getString("id")) } ?: selector
+                val result = send("resolvePaywall", "paywalls/resolve", JSONObject().put("selector", selected)
+                    .put("commerce", JSONObject().put("provider", provider.value).put("currency", currency)).put("locale", locale)).getJSONObject("paywall")
+                val key = if (selector.getString("type") == "version") "id" else "paywallId"
+                if (result.getString(key) != selector.getString(if (key == "id") "versionId" else key) ||
+                    prior != null && (result.getString("id") != prior.getString("id") || result.getJSONObject("offering").getString("id") != prior.getJSONObject("offering").getString("id") || result.getJSONObject("content").getJSONObject("artifact").getString("sha256") != prior.getJSONObject("content").getJSONObject("artifact").getString("sha256")) ||
+                    result.getJSONObject("document").getString("offeringVersionId") != result.getJSONObject("offering").getString("id")) throw IndianaClientException("invalid_response")
+                view.set(result); JSONObject(result.toString())
+            }
+            "preview" -> {
+                if (!setOf("actionId", "productVersionId", "requestId", "offerId", "nativeOffer", "featureQuantities").containsAll(input.keys().asSequence().toSet())) throw IndianaClientException("invalid_command")
+                val product = input.getString("productVersionId")
+                val policy = view.get()?.getJSONObject("document")?.getJSONObject("buttons")?.optJSONObject(input.getString("actionId")) ?: throw IndianaClientException("invalid_command")
+                if (policy.optString("type") != "checkout") throw IndianaClientException("invalid_command")
+                val selection = policy.getJSONObject("product")
+                val allowed = if (selection.getString("type") == "fixed") selection.getString("productVersionId") == product
+                    else selection.getJSONArray("allowedProductVersionIds").let { ids -> (0 until ids.length()).any { ids.getString(it) == product } }
+                if (!allowed) throw IndianaClientException("invalid_command")
+                val fingerprint = canonical(payload)
+                if (pendingPreview != null && pendingPreview != fingerprint) {
+                    val status = purchased.get()?.optString("status")
+                    if (status == null || status == "pending") throw IndianaClientException("command_pending")
+                    quoted.set(null); purchased.set(null)
+                }
+                if (pendingPreview == fingerprint) quoted.get()?.let { return@withLock JSONObject(it.toString()) }
+                val selectedPlan = JSONObject().put("productVersionId", product)
+                if (input.has("featureQuantities")) selectedPlan.put("featureQuantities", input.getJSONObject("featureQuantities"))
+                val body = JSONObject().put("requestId", input.getString("requestId"))
+                    .put("plans", JSONArray().put(selectedPlan)).put("provider", provider.value).put("currency", currency)
+                for (key in listOf("offerId", "nativeOffer")) if (input.has(key)) body.put(key, input.get(key))
+                IndianaSchema.validate("previewAttachRequest", body)
+                pendingPreview = fingerprint
+                val result = send("previewAttach", "subscriptions/preview-attach", body).getJSONObject("quote")
+                if (result.getString("provider") != provider.value || result.getString("currency") != currency || result.getJSONArray("lines").length() != 1 || result.getJSONArray("lines").getJSONObject(0).getString("productVersionId") != product) throw IndianaClientException("invalid_response")
+                quoted.set(result); purchased.set(null); JSONObject(result.toString())
+            }
+            "confirm", "cancel", "read" -> {
+                if (input.length() != 0) throw IndianaClientException("invalid_command")
+                val id = quoted.get()?.getString("operationId") ?: throw IndianaClientException("invalid_command")
+                val body = JSONObject().put("operationId", id)
+                if (action != "read") body.put("intent", action)
+                val result = send(if (action == "read") "readSubscriptionOperation" else "attach",
+                    if (action == "read") "subscriptions/operations/read" else "subscriptions/attach", body).getJSONObject("operation")
+                if (result.getString("operationId") != id || result.getString("currency") != currency) throw IndianaClientException("invalid_response")
+                purchased.get()?.takeIf { it.getString("status") == "complete" }?.let { return@withLock JSONObject(it.toString()) }
+                purchased.set(result)
+                if (result.getString("status") !in setOf("pending", "complete")) { pendingPreview = null; quoted.set(null) }
+                JSONObject(result.toString())
+            }
+            else -> throw IndianaClientException("invalid_command")
+        }
+    }
+    internal fun trustedPurchase(value: JSONObject): JSONObject {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || saved.optString("status") != "pending" || canonical(value) != canonical(saved)) throw IndianaClientException("invalid_command")
+        return JSONObject(saved.toString())
+    }
+    internal fun trustedCheckout(value: String): URI {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        val url = URI(value)
+        if (token.get() == null || saved.optString("status") != "pending" || saved.optString("checkoutUrl") != value || url.scheme != "https" || url.userInfo != null) throw IndianaClientException("invalid_command")
+        return url
+    }
+    internal fun trustedAction(value: String, type: String): String {
+        val buttons = view.get()?.getJSONObject("document")?.getJSONObject("buttons") ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || !buttons.keys().asSequence().any { key ->
+            val policy = buttons.getJSONObject(key); val action = policy.optJSONObject("action")
+            policy.optString("type") == "action" && action?.optString("type") == type && action.optString(if (type == "event") "event" else "url") == value
+        }) throw IndianaClientException("invalid_command")
+        return value
+    }
+    internal fun completedOperation(): JSONObject {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || saved.optString("status") != "complete") throw IndianaClientException("invalid_command")
+        return JSONObject(saved.toString())
+    }
+    private fun canonical(value: Any?): String = when(value) {
+        is JSONObject -> value.keys().asSequence().sorted().joinToString(",", "{", "}") { JSONObject.quote(it) + ":" + canonical(value.get(it)) }
+        is JSONArray -> (0 until value.length()).joinToString(",", "[", "]") { canonical(value.get(it)) }
+        is String -> JSONObject.quote(value)
+        null, JSONObject.NULL -> "null"
+        else -> value.toString()
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallView.kt

@@ -0,0 +1,74 @@
+package ai.tinkerland.indiana
+
+import android.app.Activity
+import android.content.Intent
+import android.graphics.Color
+import android.net.Uri
+import android.widget.FrameLayout
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import org.json.JSONObject
+import java.net.URI
+
+/** Independent Paywall using exactly the same packaged renderer as Funnel. */
+class IndianaPaywallView(private val activity: Activity, val session: IndianaPaywallSession): FrameLayout(activity) {
+    var onPurchase: (suspend (JSONObject) -> Unit)? = null
+    var onEvent: (suspend (String) -> Unit)? = null
+    var onOpenUrl: (suspend (URI) -> Unit)? = null
+    var onComplete: ((JSONObject) -> Unit)? = null
+    var onDismiss: (() -> Unit)? = null
+    var onError: ((Exception) -> Unit)? = null
+    private val work = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
+    private var stopped = false; private var dismissed = false
+    private val completions = mutableSetOf<String>()
+    private val host = IndianaBundledWebView(activity, "Paywall", work, ::dispatch) { onError?.invoke(it) }
+    init {
+        setBackgroundColor(Color.TRANSPARENT)
+        addView(host.view, LayoutParams(LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT))
+        session.onInvalidation { post { destroy() } }
+        host.start()
+    }
+    private suspend fun dispatch(method: String, raw: Any?): Any? = when (method) {
+        "ready" -> { host.send(session.hostInit()); null }
+        "paywall" -> session.hostCommand(raw as? JSONObject ?: throw IndianaClientException("invalid_command"))
+        "purchase" -> {
+            val value = (raw as? JSONObject)?.optJSONObject("operation") ?: throw IndianaClientException("invalid_command")
+            val trusted = session.trustedPurchase(value)
+            val callback = onPurchase ?: throw IndianaClientException("unsupported_capability")
+            callback(trusted); null
+        }
+        "checkout" -> {
+            val value = (raw as? JSONObject)?.optString("url") ?: throw IndianaClientException("invalid_command")
+            open(session.trustedCheckout(value)); null
+        }
+        "open" -> {
+            val value = (raw as? JSONObject)?.optString("url") ?: throw IndianaClientException("invalid_command")
+            val url = URI(session.trustedAction(value, "open_url"))
+            if (url.scheme != "https") throw IndianaClientException("invalid_command")
+            val callback = onOpenUrl
+            if (callback != null) callback(url) else open(url)
+            null
+        }
+        "event" -> {
+            val value = (raw as? JSONObject)?.optString("event") ?: throw IndianaClientException("invalid_command")
+            val trusted = session.trustedAction(value, "event")
+            val callback = onEvent ?: throw IndianaClientException("unsupported_capability")
+            callback(trusted); null
+        }
+        "complete" -> { val result = session.completedOperation(); if (completions.add(result.getString("operationId"))) { onComplete?.invoke(result) }; null }
+        "dismiss" -> { close(); null }
+        "error" -> { onError?.invoke(IndianaClientException("renderer_failed")); null }
+        else -> throw IndianaClientException("invalid_command")
+    }
+    private fun open(url: URI) { activity.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url.toString())).addCategory(Intent.CATEGORY_BROWSABLE)) }
+    fun refresh() { host.event("refresh") }
+    override fun onWindowFocusChanged(hasWindowFocus: Boolean) { super.onWindowFocusChanged(hasWindowFocus); if (hasWindowFocus) refresh() }
+    fun destroy() {
+        if (stopped) return
+        stopped = true; host.destroy(); work.cancel(); removeView(host.view); session.close()
+        if (!dismissed) { dismissed = true; onDismiss?.invoke() }
+    }
+    fun close() { destroy() }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/Protocol.kt

@@ -0,0 +1,28 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+import java.util.UUID
+import java.text.SimpleDateFormat
+import java.util.Locale
+import java.util.TimeZone
+
+data class IndianaScope(val projectId: UUID, val environment: IndianaEnvironment)
+class IndianaClientException(val code: String): Exception(code)
+internal fun uuid(value: String): UUID { require(IndianaProtocol.uuidPattern.matches(value));val id=UUID.fromString(value);require(id.toString()==value.lowercase(Locale.ROOT));return id }
+internal fun text(raw: JSONObject,key: String): String {val value=raw.get(key);require(value is String);return value}
+internal fun keys(raw: JSONObject, expected: Set<String>) { require(raw.keys().asSequence().toSet()==expected) }
+internal fun fields(raw: JSONObject, allowed: Set<String>, required: Set<String>) { val actual=raw.keys().asSequence().toSet(); require(allowed.containsAll(actual) && actual.containsAll(required)) }
+internal fun scope(raw: JSONObject): IndianaScope = safe {
+    keys(raw,IndianaProtocol.scopeKeys);IndianaScope(uuid(text(raw,"projectId")),IndianaEnvironment.entries.single {it.value==text(raw,"environment")})
+}
+internal fun utcMillis(value: String): Long = safe {
+    require(IndianaProtocol.utcPattern.matches(value))
+    val match=Regex("^(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})(?:\\.(\\d+))?(Z|[+-]\\d{2}:\\d{2})$").matchEntire(value) ?: throw IllegalArgumentException()
+    val formatter=SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss",Locale.ROOT).apply {isLenient=false;timeZone=TimeZone.getTimeZone("UTC")}
+    val date=formatter.parse(match.groupValues[1]) ?: throw IllegalArgumentException()
+    val offset = match.groupValues[3]
+    val offsetMillis = if(offset == "Z") 0L else ((offset.substring(1,3).toLong()*60 + offset.substring(4,6).toLong())*60_000) * if(offset[0] == '+') 1 else -1
+    date.time+match.groupValues[2].padEnd(3,'0').take(3).toLong()-offsetMillis
+}
+internal inline fun <T> safe(block:()->T): T = try{block()}catch(e:IndianaClientException){throw e}catch(_:Exception){throw IndianaClientException("invalid_response")}
+