@tinkerlandai/indiana-react-native 0.9.2 → 0.10.1

package/native-sdk/ios/MerchantCommerceSemantics.swift

@@ -0,0 +1,51 @@
+import Foundation
+
+/// Merchant refinements dispatch on generated DTO fields, not user JSON.
+enum IndianaMerchantCommerceSemantics {
+    static func validate(_ v: [String: Any], fields: Set<String>) throws {
+        func has(_ keys: [String]) -> Bool { Set(keys).isSubset(of: fields) }
+        let require = IndianaCustomerResponseSemantics.require
+        let o = IndianaCustomerResponseSemantics.o, a = IndianaCustomerResponseSemantics.a
+        let s = IndianaCustomerResponseSemantics.s, n = IndianaCustomerResponseSemantics.n
+        let nilValue = IndianaCustomerResponseSemantics.nilValue
+        if has(["configurationRevision", "connectionRevision", "lineItems", "catalogAmountMinor", "discount"]) {
+            let lines = a(v["lineItems"]), discount = o(v["discount"])
+            try require(lines.reduce(0) { $0 + n($1["totalMinor"]) } == n(v["catalogAmountMinor"]) && (discount.isEmpty || n(discount["amountMinor"]) <= n(v["catalogAmountMinor"])) && Set(lines.map { s($0["priceId"]) }).count == lines.count)
+        }
+        if has(["phase", "code", "reason", "retryable", "recovery"]), s(v["reason"]) == "RESULT_UNKNOWN" {
+            try require(v["retryable"] as? Bool == false && s(v["recovery"]) == "recover_operation")
+        }
+        if has(["merchantExecutionId", "paymentStatus", "checkoutUrl", "checkoutExpiresAt"]), !nilValue(v["checkoutUrl"]) {
+            try require(["not_started", "pending"].contains(s(v["paymentStatus"])) && !nilValue(v["checkoutExpiresAt"]))
+        }
+        if has(["merchantExecutionId", "scheduledFor", "status"]) || has(["provider", "eventId", "subscription", "scheduledFor", "status"]) {
+            try require((s(v["status"]) == "scheduled") == !nilValue(v["scheduledFor"]))
+        }
+        if has(["merchantExecutionId", "merchantRefundId", "status"]), s(v["status"]) == "succeeded" { try require(!nilValue(v["merchantRefundId"])) }
+        if has(["lookup", "operationId", "customerId", "execution"]), let execution = v["execution"] as? [String: Any] {
+            try require(s(execution["operationId"]) == s(v["operationId"]) && s(execution["customerId"]) == s(v["customerId"]))
+        }
+        if has(["scope", "operationId", "customerId", "confirmedAt", "initialExecutionAllowed", "instruction"]) {
+            let instruction = o(v["instruction"])
+            try require(s(instruction["operationId"]) == s(v["operationId"]) && s(instruction["customerId"]) == s(v["customerId"]))
+        }
+        if has(["merchantSubscriptionId", "periodStartsAt", "periodEndsAt", "items"]) {
+            let items = a(v["items"])
+            try require(IndianaCustomerResponseSemantics.time(v["periodEndsAt"]) > IndianaCustomerResponseSemantics.time(v["periodStartsAt"]) && Set(items.map { s($0["priceId"]) }).count == items.count)
+        }
+        if has(["merchantInvoiceId", "subtotalMinor", "discountMinor", "taxMinor", "totalMinor", "paidMinor"]) {
+            try require(n(v["subtotalMinor"]) - n(v["discountMinor"]) + n(v["taxMinor"]) == n(v["totalMinor"]) && n(v["discountMinor"]) <= n(v["subtotalMinor"]) && n(v["paidMinor"]) == n(v["totalMinor"]))
+        }
+        if has(["merchantInvoiceId", "lines", "paidMinor"]) {
+            let lines = a(v["lines"])
+            try require(Set(lines.map { s($0["merchantLineId"]) }).count == lines.count)
+            for key in ["subtotalMinor", "discountMinor", "taxMinor", "totalMinor"] { try require(lines.reduce(0) { $0 + n($1[key]) } == n(v[key])) }
+        }
+        if has(["merchantLineId", "subtotalMinor", "discountMinor", "taxMinor", "totalMinor"]) {
+            let subtotal = n(v["subtotalMinor"]), discount = n(v["discountMinor"]), tax = n(v["taxMinor"])
+            try require(subtotal - discount + tax == n(v["totalMinor"]) && (subtotal < 0 ? discount == 0 && tax == 0 : discount <= subtotal))
+        }
+        if has(["provider", "eventId", "merchantOrderId", "paymentStatus", "invoice"]), s(v["paymentStatus"]) == "paid" { try require(!nilValue(v["invoice"])) }
+        if has(["provider", "merchantInvoiceId", "cancelSubscriptions", "entitlementAction", "amountMinor"]) || has(["provider", "eventId", "merchantRefundId", "amountMinor", "status"]) { try require(n(v["amountMinor"]) > 0) }
+    }
+}

package/native-sdk/ios/NativePendingKeychain.swift

@@ -0,0 +1,52 @@
+import Foundation
+import Security
+
+struct IndianaNativePendingOrder: Codable, Sendable, Equatable {
+    let runId: UUID; let orderId: UUID; let receiptId: UUID; let productId: String; let accountToken: UUID
+}
+/// Stores only current order bindings; never a run token, customer token or JWS.
+protocol IndianaNativePendingStorage: Sendable {
+    func read(_ order: UUID) async throws -> IndianaNativePendingOrder?
+    func orders() async throws -> [IndianaNativePendingOrder]
+    func orders(runId: UUID) async throws -> [IndianaNativePendingOrder]
+    func contains(_ record: IndianaNativePendingOrder) async throws -> Bool
+    func put(_ record: IndianaNativePendingOrder) async throws
+    func remove(_ order: UUID) async throws
+}
+actor IndianaNativePendingKeychain: IndianaNativePendingStorage {
+    private let service: String
+    init(scope: IndianaScope) { service = "\(Bundle.main.bundleIdentifier ?? "Indiana").grow.funnel.orders.v1.\(scope.projectId.uuidString.lowercased()).\(scope.environment.rawValue)" }
+    private func query(_ order: UUID) -> [String: Any] { [kSecClass as String:kSecClassGenericPassword,kSecAttrService as String:service,kSecAttrAccount as String:order.uuidString.lowercased()] }
+    func read(_ order: UUID) throws -> IndianaNativePendingOrder? {
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query(order).merging([kSecReturnData as String:true]) { _, new in new } as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data, data.count <= 4096, let original = try? JSONDecoder().decode(IndianaNativePendingOrder.self, from: data), original.orderId == order else { throw IndianaClientError.protectedStorageUnavailable }
+        return original
+    }
+    private func allOrders() throws -> [IndianaNativePendingOrder] {
+        let query: [String: Any] = [kSecClass as String:kSecClassGenericPassword,kSecAttrService as String:service,kSecReturnData as String:true,kSecMatchLimit as String:kSecMatchLimitAll]
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound { return [] }
+        guard status == errSecSuccess, let bytes = result as? [Data], bytes.count <= 100 else { throw IndianaClientError.protectedStorageUnavailable }
+        return try bytes.map { data in
+            guard data.count <= 4096 else { throw IndianaClientError.protectedStorageUnavailable }
+            return try JSONDecoder().decode(IndianaNativePendingOrder.self, from: data)
+        }
+    }
+    func orders() throws -> [IndianaNativePendingOrder] { try allOrders() }
+    func orders(runId: UUID) throws -> [IndianaNativePendingOrder] { try allOrders().filter { $0.runId == runId } }
+    func contains(_ record: IndianaNativePendingOrder) throws -> Bool {
+        guard let original = try read(record.orderId) else { return false }; guard original == record else { throw IndianaClientError.protectedStorageUnavailable }; return true
+    }
+    func put(_ record: IndianaNativePendingOrder) throws {
+        if try contains(record) { return }
+        guard try allOrders().count < 100 else { throw IndianaClientError.protectedStorageUnavailable }
+        let bytes = try JSONEncoder().encode(record)
+        let status = SecItemAdd(query(record.orderId).merging([kSecValueData as String:bytes,kSecAttrAccessible as String:kSecAttrAccessibleWhenUnlockedThisDeviceOnly]) { _, new in new } as CFDictionary, nil)
+        if status == errSecDuplicateItem { guard try contains(record) else { throw IndianaClientError.protectedStorageUnavailable }; return }
+        guard status == errSecSuccess else { throw IndianaClientError.protectedStorageUnavailable }
+    }
+    func remove(_ order: UUID) throws { let status = SecItemDelete(query(order) as CFDictionary); guard status == errSecSuccess || status == errSecItemNotFound else { throw IndianaClientError.protectedStorageUnavailable } }
+}

package/native-sdk/ios/NativeReceiptRelay.swift

@@ -0,0 +1,28 @@
+import Foundation
+
+struct IndianaNativeCompletion: Codable, Sendable { let orderId: UUID; let receiptId: UUID; let membership: Bool; let transactionIds: [String] }
+
+/// HTTPS endpoint on your own backend. It authenticates the customer and attaches the Indiana server key there.
+public final class IndianaNativeReceiptRelay: Sendable {
+    private let endpoint: URL; private let session: URLSession
+    public init(endpoint: URL) throws {
+        guard endpoint.scheme == "https", endpoint.host != nil, endpoint.user == nil, endpoint.password == nil, endpoint.query == nil, endpoint.fragment == nil else { throw IndianaClientError.invalidConfiguration }
+        self.endpoint = endpoint
+        let config = URLSessionConfiguration.ephemeral; config.urlCache = nil; config.httpCookieStorage = nil; config.requestCachePolicy = .reloadIgnoringLocalCacheData; config.timeoutIntervalForRequest = 35
+        session = URLSession(configuration: config, delegate: NoRedirect(), delegateQueue: nil)
+    }
+    public func send(_ body: Data) async throws -> Data {
+        guard body.count <= 262144, let input = try? JSONDecoder().decode(IndianaJSON.self, from: body).object, input["operation"] == .string("native_receipt"), let token = input["customerToken"]?.string, token.range(of: "^gg_ct_[A-Za-z0-9_-]{32,128}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidConfiguration }
+        var request = URLRequest(url: endpoint); request.httpMethod = "POST"; request.httpBody = body
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type"); request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        do {
+            let (stream, response) = try await session.bytes(for: request)
+            guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else { throw IndianaClientError.requestFailed((response as? HTTPURLResponse)?.statusCode ?? 0) }
+            guard response.expectedContentLength <= 262144 else { throw IndianaClientError.invalidResponse }
+            var result = Data(); for try await byte in stream { guard result.count < 262144 else { throw IndianaClientError.invalidResponse }; result.append(byte) }; return result
+        } catch let error as IndianaClientError { throw error } catch { throw IndianaClientError.temporaryUnavailable }
+    }
+    private final class NoRedirect: NSObject, URLSessionTaskDelegate, Sendable {
+        func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) { completionHandler(nil) }
+    }
+}

package/native-sdk/ios/NativeStoreOffer.swift

@@ -0,0 +1,34 @@
+import Foundation
+
+public enum IndianaNativeOfferKind: String, Sendable { case none, introductory, promotional }
+
+/// The selected store quote belongs to this purchase, not the reusable SKU binding.
+public struct IndianaNativeStoreOffer: Sendable {
+    public let offerKind: IndianaNativeOfferKind
+    public let offerID: String?
+    public let discountMinor: Int
+    public let trialDays: Int?
+
+    public init(offerKind: IndianaNativeOfferKind, offerID: String? = nil, discountMinor: Int = 0, trialDays: Int? = nil) throws {
+        guard (0...100000000).contains(discountMinor), trialDays == nil || (1...730).contains(trialDays!),
+              offerID == nil || offerID!.range(of: "^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$", options: .regularExpression) != nil,
+              trialDays == nil || discountMinor == 0,
+              offerKind != .none || (offerID == nil && discountMinor == 0 && trialDays == nil) else { throw IndianaClientError.invalidResponse }
+        self.offerKind = offerKind; self.offerID = offerID; self.discountMinor = discountMinor; self.trialDays = trialDays
+    }
+
+    var wire: IndianaJSON { .object([
+        "offerKind": .string(offerKind.rawValue), "offerId": offerID.map(IndianaJSON.string) ?? .null,
+        "discountMinor": .number(Double(discountMinor)), "trialDays": trialDays.map { .number(Double($0)) } ?? .null
+    ]) }
+
+    func matches(_ provider: IndianaSubscriptionProvider) -> Bool {
+        switch provider {
+        case .stripe, .merchant: return false
+        case .apple: return (offerKind == .promotional) == (offerID != nil)
+        case .google:
+            return (offerKind == .none) == (offerID == nil) &&
+                (offerID == nil || offerID!.range(of: "^[a-z0-9][a-z0-9-]*$", options: .regularExpression) != nil)
+        }
+    }
+}

package/native-sdk/ios/PaywallContent.swift

@@ -0,0 +1,75 @@
+import Foundation
+import CryptoKit
+
+/// Only immutable JSON crosses this public transport. Business credentials never enter it.
+final class IndianaPaywallContent: Sendable {
+    private static let presentationFields = ["amountMinor", "interval", "intervalCount", "prepaid"]
+    /// Hydration may add catalog presentation fields, but cannot change authenticated delivery facts.
+    static func validatesHydration(_ loaded: [String: IndianaJSON], delivery: [String: IndianaJSON]) -> Bool {
+        var protected = loaded.filter { !["document", "offering"].contains($0.key) }
+        if var capabilities = protected["capabilities"]?.object, var plans = capabilities["plans"]?.object {
+            let original = delivery["capabilities"]?.object?["plans"]?.object ?? [:]
+            for (id, entry) in plans {
+                guard var plan = entry.object else { return false }
+                for key in presentationFields where original[id]?.object?[key] == nil { plan.removeValue(forKey: key) }
+                plans[id] = .object(plan)
+            }
+            capabilities["plans"] = .object(plans); protected["capabilities"] = .object(capabilities)
+        }
+        return protected == delivery
+    }
+    static func applyPresentation(_ loaded: [String: IndianaJSON], to latest: inout [String: IndianaJSON]) {
+        latest["document"] = loaded["document"]; latest["offering"] = loaded["offering"]
+        guard var capabilities = latest["capabilities"]?.object, var plans = capabilities["plans"]?.object,
+              let hydrated = loaded["capabilities"]?.object?["plans"]?.object else { return }
+        for (id, entry) in plans {
+            guard var plan = entry.object, let source = hydrated[id]?.object, source["currency"] == plan["currency"] else { continue }
+            for key in presentationFields where source[key] != nil { plan[key] = source[key] }
+            plans[id] = .object(plan)
+        }
+        capabilities["plans"] = .object(plans); latest["capabilities"] = .object(capabilities)
+    }
+    private let relay: IndianaFunnelConfigurationRelay
+    init(configuration: IndianaConfiguration) { relay = IndianaFunnelConfigurationRelay(configuration: configuration) }
+    func resolve(_ delivery: IndianaJSON) async throws -> IndianaJSON {
+        try IndianaSchema.validate("paywallDelivery", data: JSONEncoder().encode(delivery))
+        guard let value = delivery.object, let content = value["content"]?.object,
+              let environment = content["environmentId"]?.string, let artifact = content["artifact"]?.object,
+              let digest = artifact["sha256"]?.string, let path = artifact["url"]?.string,
+              artifact["kind"] == .string("paywall"), artifact["formatVersion"] == .number(1),
+              path == "/api/v1/configuration/\(environment)/artifacts/\(digest)",
+              artifact["byteLength"] != nil else { throw IndianaClientError.invalidResponse }
+        let reply = try await relay.read(.object(["path": .string(path)]))
+        guard reply.object?["status"] == .number(200),
+              let type = reply.object?["headers"]?.object?["content-type"]?.string, type.lowercased().hasPrefix("application/json"),
+              let text = reply.object?["body"]?.string, let data = text.data(using: .utf8) else { throw IndianaClientError.invalidResponse }
+        return try Self.hydrate(delivery, bytes: data)
+    }
+    static func hydrate(_ delivery: IndianaJSON, bytes data: Data) throws -> IndianaJSON {
+        try IndianaSchema.validate("paywallDelivery", data: JSONEncoder().encode(delivery))
+        guard var value = delivery.object, let content = value["content"]?.object, let artifact = content["artifact"]?.object,
+              artifact["kind"] == .string("paywall"), artifact["formatVersion"] == .number(1),
+              let digest = artifact["sha256"]?.string, case .number(let expected) = artifact["byteLength"], data.count == Int(expected),
+              SHA256.hash(data: data).map({ String(format: "%02x", $0) }).joined() == digest else { throw IndianaClientError.invalidResponse }
+        try IndianaSchema.validate("publicPaywall", data: data)
+        guard let file = try JSONDecoder().decode(IndianaJSON.self, from: data).object,
+              file["offeringVersionId"] == content["offeringVersionId"] else { throw IndianaClientError.invalidResponse }
+        let keys: Set<String> = ["kind", "name", "presentation", "products", "offeringVersionId", "screen", "buttons"]
+        var document = file.filter { keys.contains($0.key) }; document["schemaVersion"] = .number(3)
+        value["document"] = .object(document); value["offering"] = .object(["id": file["offeringVersionId"]!])
+        if var capabilities = value["capabilities"]?.object, var plans = capabilities["plans"]?.object, let catalog = file["catalog"]?.object {
+            for (id, entry) in catalog {
+                guard var plan = plans[id]?.object, let product = entry.object,
+                      let currency = plan["currency"]?.string,
+                      case .array(let prices) = product["channels"]?.object?["stripe"]?.object?["prices"],
+                      let price = prices.first(where: { $0.object?["currency"]?.string == currency })?.object else { continue }
+                plan["amountMinor"] = price["amountMinor"]; plan["interval"] = product["interval"]; plan["intervalCount"] = product["intervalCount"]
+                plan["prepaid"] = product["prepaid"]; plans[id] = .object(plan)
+            }
+            capabilities["plans"] = .object(plans); value["capabilities"] = .object(capabilities)
+        }
+        let hydrated = IndianaJSON.object(value)
+        try IndianaSchema.validate("paywallResolution", data: JSONEncoder().encode(hydrated))
+        return hydrated
+    }
+}

package/native-sdk/ios/PaywallSession.swift

@@ -0,0 +1,124 @@
+import Foundation
+
+/// Independent Paywall identity and commercial state. No Funnel or browser credential is created.
+public actor IndianaPaywallSession {
+    private let configuration: IndianaConfiguration
+    private let http: any IndianaHTTP
+    private let content: @Sendable (IndianaJSON) async throws -> IndianaJSON
+    private var token: String?
+    private let selector: IndianaJSON
+    private let provider: IndianaSubscriptionProvider
+    private let currency: String
+    private let locale: String
+    private var busy = false
+    private var closed = false
+    private var invalidation: (@Sendable () -> Void)?
+    private var pendingPreview: Data?
+    private var quote: IndianaJSON?
+    private var operation: IndianaJSON?
+    public private(set) var current: IndianaJSON?
+
+    init(configuration: IndianaConfiguration, http: any IndianaHTTP, customerToken: String, paywallId: UUID?, versionId: UUID?, provider: IndianaSubscriptionProvider, currency: String, locale: String, content: (@Sendable (IndianaJSON) async throws -> IndianaJSON)? = nil) throws {
+        guard (paywallId == nil) != (versionId == nil), !locale.isEmpty, locale.count <= 35,
+              currency.range(of: "^[A-Z]{3}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidConfiguration }
+        self.configuration = configuration; self.http = http; self.token = customerToken
+        let reader = IndianaPaywallContent(configuration: configuration)
+        self.content = content ?? { try await reader.resolve($0) }
+        self.provider = provider; self.currency = currency; self.locale = locale
+        selector = paywallId.map { .object(["type":.string("paywall"),"paywallId":.string($0.uuidString.lowercased())]) }
+            ?? .object(["type":.string("version"),"versionId":.string(versionId!.uuidString.lowercased())])
+    }
+    public func close() { closed = true; token = nil; current = nil; quote = nil; operation = nil; pendingPreview = nil; invalidation?(); invalidation = nil }
+    internal func onInvalidation(_ callback: @escaping @Sendable () -> Void) { if closed { callback() } else { invalidation = callback } }
+    internal func hostConfiguration() -> IndianaConfiguration { configuration }
+    internal func hostInit() -> IndianaJSON {
+        .object(["event":.string("init"),"surface":.string("paywall"),"scope":.object(["projectId":.string(configuration.scope.projectId.uuidString.lowercased()),"environment":.string(configuration.scope.environment.rawValue)]),"apiOrigin":.string(configuration.apiOrigin)])
+    }
+    private func send(_ name: String, path: String, body: IndianaJSON) async throws -> IndianaJSON {
+        guard let token, !closed else { throw IndianaClientError.identityChanged }
+        let data = try JSONEncoder().encode(body)
+        try IndianaSchema.validate(name + "Request", data: data)
+        let result: Data
+        do { result = try await http.send(path: path, method: "POST", authorization: token, body: data) }
+        catch { guard !closed else { throw IndianaClientError.identityChanged }; throw error }
+        guard !closed else { throw IndianaClientError.identityChanged }
+        try IndianaSchema.validate(name + "Response", data: result)
+        struct Scoped: Decodable { let scope: IndianaScope }
+        guard try JSONDecoder().decode(Scoped.self, from: result).scope == configuration.scope else { throw IndianaClientError.invalidResponse }
+        var reply = try JSONDecoder().decode(IndianaJSON.self, from: result).object!
+        if name == "resolvePaywall" { reply["paywall"] = try await content(reply["paywall"]!); guard !closed else { throw IndianaClientError.identityChanged } }
+        return .object(reply)
+    }
+    private func canonical(_ value: IndianaJSON) throws -> Data { let encoder = JSONEncoder(); encoder.outputFormatting = .sortedKeys; return try encoder.encode(value) }
+    public func refresh() async throws -> IndianaJSON { try await hostCommand(.object(["operation":.string("resolve"),"input":.object([:])])) }
+    internal func hostCommand(_ payload: IndianaJSON) async throws -> IndianaJSON {
+        guard !closed, !busy, let envelope = payload.object, Set(envelope.keys) == Set(["operation","input"]), let action = envelope["operation"]?.string, let input = envelope["input"]?.object else { throw IndianaFunnelError.invalidCommand }
+        busy = true; defer { busy = false }
+        switch action {
+        case "resolve":
+            guard input.isEmpty else { throw IndianaFunnelError.invalidCommand }
+            let selected = current?.object?["id"].map { IndianaJSON.object(["type":.string("version"),"versionId":$0]) } ?? selector
+            let reply = try await send("resolvePaywall", path: "paywalls/resolve", body: .object(["selector":selected,"commerce":.object(["provider":.string(provider.rawValue),"currency":.string(currency)]),"locale":.string(locale)]))
+            guard let value = reply.object?["paywall"], let wall = value.object else { throw IndianaClientError.invalidResponse }
+            let key = selector.object?["type"]?.string == "version" ? "id" : "paywallId"
+            guard wall[key] == selector.object?[key == "id" ? "versionId" : "paywallId"],
+                  current == nil || (wall["id"] == current?.object?["id"] && wall["offering"]?.object?["id"] == current?.object?["offering"]?.object?["id"] && wall["content"]?.object?["artifact"]?.object?["sha256"] == current?.object?["content"]?.object?["artifact"]?.object?["sha256"]),
+                  wall["document"]?.object?["offeringVersionId"] == wall["offering"]?.object?["id"] else { throw IndianaClientError.invalidResponse }
+            current = value; return value
+        case "preview":
+            guard Set(input.keys).isSubset(of: ["actionId","productVersionId","requestId","offerId","nativeOffer","featureQuantities"]),
+                  let actionId = input["actionId"]?.string, let product = input["productVersionId"]?.string,
+                  let policy = current?.object?["document"]?.object?["buttons"]?.object?[actionId]?.object, policy["type"]?.string == "checkout",
+                  let selection = policy["product"]?.object else { throw IndianaFunnelError.invalidCommand }
+            let allowed: Bool
+            if selection["type"]?.string == "fixed" { allowed = selection["productVersionId"]?.string == product }
+            else if case .array(let ids) = selection["allowedProductVersionIds"] { allowed = ids.contains(.string(product)) }
+            else { allowed = false }
+            guard allowed else { throw IndianaFunnelError.invalidCommand }
+            let fingerprint = try canonical(payload)
+            if let pendingPreview, pendingPreview != fingerprint {
+                guard let status = operation?.object?["status"]?.string, status != "pending" else { throw IndianaFunnelError.commandPending }
+                quote = nil; operation = nil
+            }
+            if pendingPreview == fingerprint, let quote { return quote }
+            var selectedPlan: [String:IndianaJSON] = ["productVersionId":.string(product)]
+            selectedPlan["featureQuantities"] = input["featureQuantities"]
+            var fields: [String:IndianaJSON] = ["requestId":input["requestId"] ?? .null,"plans":.array([.object(selectedPlan)]),"provider":.string(provider.rawValue),"currency":.string(currency)]
+            fields["offerId"] = input["offerId"]; fields["nativeOffer"] = input["nativeOffer"]
+            let body = IndianaJSON.object(fields)
+            try IndianaSchema.validate("previewAttachRequest", data: JSONEncoder().encode(body))
+            pendingPreview = fingerprint
+            let reply = try await send("previewAttach", path:"subscriptions/preview-attach",body:body)
+            guard let value = reply.object?["quote"], let q = value.object, q["currency"]?.string == currency, q["provider"]?.string == provider.rawValue,
+                  case .array(let lines) = q["lines"], lines.count == 1, lines[0].object?["productVersionId"]?.string == product else { throw IndianaClientError.invalidResponse }
+            quote = value; operation = nil; return value
+        case "confirm", "cancel", "read":
+            guard input.isEmpty, let id = quote?.object?["operationId"] else { throw IndianaFunnelError.invalidCommand }
+            let body = action == "read" ? IndianaJSON.object(["operationId":id]) : .object(["operationId":id,"intent":.string(action)])
+            let reply = try await send(action == "read" ? "readSubscriptionOperation" : "attach", path: action == "read" ? "subscriptions/operations/read" : "subscriptions/attach", body:body)
+            guard let value = reply.object?["operation"], value.object?["operationId"] == id, value.object?["currency"]?.string == currency else { throw IndianaClientError.invalidResponse }
+            if operation?.object?["status"]?.string == "complete" { return operation! }
+            operation = value
+            if value.object?["status"]?.string != "pending" && value.object?["status"]?.string != "complete" { pendingPreview = nil; quote = nil }
+            return value
+        default: throw IndianaFunnelError.invalidCommand
+        }
+    }
+    internal func trustedPurchase(_ value: IndianaJSON) throws -> IndianaJSON {
+        guard !closed, value == operation, value.object?["status"]?.string == "pending" else { throw IndianaFunnelError.invalidCommand }; return value
+    }
+    internal func trustedCheckout(_ value: String) throws -> URL {
+        guard !closed, operation?.object?["status"]?.string == "pending", operation?.object?["checkoutUrl"]?.string == value, let url=URL(string:value), url.scheme == "https", url.user == nil, url.password == nil else { throw IndianaFunnelError.invalidCommand }; return url
+    }
+    internal func trustedAction(_ value: String, type: String) throws -> String {
+        guard !closed, let buttons=current?.object?["document"]?.object?["buttons"]?.object else { throw IndianaFunnelError.invalidCommand }
+        for policy in buttons.values {
+            let action=policy.object?["action"]?.object
+            if policy.object?["type"]?.string == "action", action?["type"]?.string == type, action?[type == "event" ? "event" : "url"]?.string == value { return value }
+        }
+        throw IndianaFunnelError.invalidCommand
+    }
+    internal func completedOperation() throws -> IndianaJSON {
+        guard !closed, let operation, operation.object?["status"]?.string == "complete" else { throw IndianaFunnelError.invalidCommand }; return operation
+    }
+}

package/native-sdk/ios/PaywallView.swift

@@ -0,0 +1,87 @@
+#if canImport(UIKit)
+import UIKit
+@preconcurrency import SafariServices
+import SwiftUI
+
+/// Independent Paywall UI using the same packaged renderer as Funnel.
+@MainActor public final class IndianaPaywallViewController: UIViewController, @preconcurrency SFSafariViewControllerDelegate {
+    public let session: IndianaPaywallSession
+    public var onPurchase: (@MainActor (IndianaJSON) async throws -> Void)?
+    public var onEvent: (@MainActor (String) async throws -> Void)?
+    public var onOpenURL: (@MainActor (URL) async throws -> Void)?
+    public var onComplete: (@MainActor (IndianaJSON) -> Void)?
+    public var onDismiss: (@MainActor () -> Void)?
+    public var onError: (@MainActor (Error) -> Void)?
+    private var host: IndianaBundledWebView!
+    private var stopped = false, dismissed = false
+    private var completions = Set<String>()
+    private var observer: IndianaForegroundObserver?
+    public init(session:IndianaPaywallSession) { self.session=session; super.init(nibName:nil,bundle:nil) }
+    required init?(coder:NSCoder) { fatalError("Use init(session:)") }
+    public override func loadView() {
+        host = IndianaBundledWebView(label:"Paywall",dispatch:{ [weak self] method,payload in
+            guard let self, !self.stopped else { throw IndianaClientError.identityChanged }
+            return try await self.dispatch(method,payload)
+        },onError:{ [weak self] error in self?.onError?(error) })
+        view=host.webView
+        Task {
+            await session.onInvalidation { [weak self] in Task { @MainActor in self?.invalidate() } }
+            guard !stopped else { return }; host.start()
+        }
+        observer=IndianaForegroundObserver { [weak self] in
+            Task { @MainActor in self?.host?.event("refresh") }
+        }
+    }
+    public func close() async { await session.close(); invalidate() }
+    private func invalidate() {
+        guard !stopped else { return }; stopped=true; host?.destroy()
+        observer=nil
+        presentedViewController?.dismiss(animated:false)
+        if !dismissed { dismissed=true; onDismiss?() }
+    }
+    private func dispatch(_ method:String,_ payload:IndianaJSON) async throws -> IndianaJSON {
+        switch method {
+        case "ready": host.send(await session.hostInit()); return .null
+        case "paywall": return try await session.hostCommand(payload)
+        case "purchase":
+            guard let value=payload.object?["operation"], let onPurchase else { throw IndianaClientError.unsupportedCapability }
+            try await onPurchase(try await session.trustedPurchase(value)); return .null
+        case "checkout":
+            guard let raw=payload.object?["url"]?.string else { throw IndianaFunnelError.invalidCommand }
+            open(try await session.trustedCheckout(raw)); return .null
+        case "open":
+            guard let raw=payload.object?["url"]?.string else { throw IndianaFunnelError.invalidCommand }
+            let trusted=try await session.trustedAction(raw,type:"open_url")
+            guard let url=URL(string:trusted),url.scheme == "https" else { throw IndianaFunnelError.invalidCommand }
+            if let onOpenURL { try await onOpenURL(url) } else { open(url) }; return .null
+        case "event":
+            guard let raw=payload.object?["event"]?.string,let onEvent else { throw IndianaClientError.unsupportedCapability }
+            try await onEvent(try await session.trustedAction(raw,type:"event")); return .null
+        case "complete":
+            let result=try await session.completedOperation()
+            if let id=result.object?["operationId"]?.string, completions.insert(id).inserted { onComplete?(result) }; return .null
+        case "dismiss": await close(); return .null
+        case "error": onError?(IndianaClientError.invalidResponse); return .null
+        default: throw IndianaFunnelError.invalidCommand
+        }
+    }
+    private func open(_ url:URL) { let browser=SFSafariViewController(url:url);browser.delegate=self;present(browser,animated:true) }
+    public func safariViewControllerDidFinish(_ controller:SFSafariViewController) { controller.dismiss(animated:true);host?.event("refresh") }
+}
+
+@MainActor public struct IndianaPaywallView: UIViewControllerRepresentable {
+    public let session:IndianaPaywallSession
+    public var onPurchase:(@MainActor (IndianaJSON) async throws -> Void)?
+    public var onEvent:(@MainActor (String) async throws -> Void)?
+    public var onOpenURL:(@MainActor (URL) async throws -> Void)?
+    public var onComplete:(@MainActor (IndianaJSON) -> Void)?
+    public var onDismiss:(@MainActor () -> Void)?
+    public var onError:(@MainActor (Error) -> Void)?
+    public init(session:IndianaPaywallSession,onPurchase:(@MainActor (IndianaJSON) async throws -> Void)?=nil,onEvent:(@MainActor (String) async throws -> Void)?=nil,onOpenURL:(@MainActor (URL) async throws -> Void)?=nil,onComplete:(@MainActor (IndianaJSON) -> Void)?=nil,onDismiss:(@MainActor () -> Void)?=nil,onError:(@MainActor (Error) -> Void)?=nil) {
+        self.session=session;self.onPurchase=onPurchase;self.onEvent=onEvent;self.onOpenURL=onOpenURL;self.onComplete=onComplete;self.onDismiss=onDismiss;self.onError=onError
+    }
+    public func makeUIViewController(context:Context)->IndianaPaywallViewController { let controller=IndianaPaywallViewController(session:session);updateUIViewController(controller,context:context);return controller }
+    public func updateUIViewController(_ controller:IndianaPaywallViewController,context:Context) { controller.onPurchase=onPurchase;controller.onEvent=onEvent;controller.onOpenURL=onOpenURL;controller.onComplete=onComplete;controller.onDismiss=onDismiss;controller.onError=onError }
+    public static func dismantleUIViewController(_ controller:IndianaPaywallViewController,coordinator:()) { Task { await controller.close() } }
+}
+#endif

package/native-sdk/ios/Protocol.swift

@@ -0,0 +1,49 @@
+import Foundation
+
+public struct IndianaScope: Codable, Sendable, Equatable {
+    public let projectId: UUID
+    public let environment: IndianaEnvironment
+    public init(projectId: UUID, environment: IndianaEnvironment) { self.projectId = projectId; self.environment = environment }
+    public init(from decoder: Decoder) throws {
+        try IndianaWire.keys(decoder, IndianaProtocol.scopeKeys)
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        projectId = try IndianaWire.uuid(c.decode(String.self, forKey: .projectId)); environment = try c.decode(IndianaEnvironment.self, forKey: .environment)
+    }
+}
+public enum IndianaClientError: Error, Sendable {
+    case invalidConfiguration, unauthenticated, identityChanged, unsupportedCapability, invalidResponse, requestFailed(Int), temporaryUnavailable, protectedStorageUnavailable
+}
+enum IndianaDates {
+    static func parse(_ value: String) -> Date? {
+        guard value.range(of: IndianaProtocol.utcPattern, options: .regularExpression) != nil else { return nil }
+        // The current contract permits ISO timestamps with fractional precision and UTC offsets. Preserve the wire
+        // string and reduce only the Date conversion to nanoseconds after validating its calendar.
+        var parseValue = value
+        if let match = value.range(of: "(?<=\\.)[0-9]+", options: .regularExpression) {
+            parseValue.replaceSubrange(match, with: value[match].prefix(9))
+        }
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        if let date = formatter.date(from: parseValue) { return date }
+        formatter.formatOptions = [.withInternetDateTime]
+        return formatter.date(from: parseValue)
+    }
+}
+enum IndianaWire {
+    static func uuid(_ value: String) throws -> UUID {
+        guard value.range(of: IndianaProtocol.uuidPattern, options: .regularExpression) != nil,
+              let id = UUID(uuidString: value) else { throw IndianaClientError.invalidResponse }
+        return id
+    }
+    private struct Key: CodingKey { let stringValue: String; let intValue: Int? = nil; init?(stringValue: String) { self.stringValue = stringValue }; init?(intValue: Int) { return nil } }
+    static func keys(_ decoder: Decoder, _ expected: Set<String>) throws {
+        let c = try decoder.container(keyedBy: Key.self)
+        guard Set(c.allKeys.map(\.stringValue)) == expected else { throw IndianaClientError.invalidResponse }
+    }
+    static func fields(_ decoder: Decoder, allowed: Set<String>, required: Set<String>) throws {
+        let c = try decoder.container(keyedBy: Key.self)
+        let actual = Set(c.allKeys.map(\.stringValue))
+        guard actual.isSubset(of: allowed), required.isSubset(of: actual) else { throw IndianaClientError.invalidResponse }
+    }
+}
+