@tinkerlandai/indiana-react-native 0.9.2 → 0.9.5

package/native-sdk/android/java/ai/tinkerland/indiana/NativeReceiptRelay.kt

@@ -0,0 +1,28 @@
+package ai.tinkerland.indiana
+
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+import java.net.URI
+import java.net.HttpURLConnection
+import java.io.ByteArrayOutputStream
+
+/** The endpoint is your trusted app backend. No Indiana server API key belongs on the device. */
+class IndianaNativeReceiptRelay(endpoint: String) {
+    private val url = URI(endpoint).also { require(it.scheme == "https" && it.host != null && it.rawUserInfo == null && it.rawQuery == null && it.rawFragment == null) }.toURL()
+    suspend fun send(body: JSONObject): JSONObject = withContext(Dispatchers.IO) {
+        val token = body.opt("customerToken") as? String ?: throw IndianaClientException("unauthenticated")
+        val bytes = body.toString().toByteArray(Charsets.UTF_8)
+        if (body.optString("operation") != "native_receipt" || !token.matches(Regex("gg_ct_[A-Za-z0-9_-]{32,128}")) || bytes.size > 262144) throw IndianaClientException("invalid_command")
+        val connection = url.openConnection() as HttpURLConnection
+        try {
+            connection.requestMethod = "POST"; connection.instanceFollowRedirects = false; connection.useCaches = false; connection.connectTimeout = 35000; connection.readTimeout = 35000
+            connection.setRequestProperty("Content-Type", "application/json"); connection.setRequestProperty("Authorization", "Bearer $token")
+            connection.doOutput = true; connection.setFixedLengthStreamingMode(bytes.size); connection.outputStream.use { it.write(bytes) }
+            if (connection.responseCode !in 200..299) throw IndianaClientException("request_failed_${connection.responseCode}")
+            if ((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0) > 262144) throw IndianaClientException("invalid_response")
+            val output = ByteArrayOutputStream(); connection.inputStream.use { input -> val buffer = ByteArray(8192); while (true) { val count = input.read(buffer); if (count < 0) break; if (output.size() + count > 262144) throw IndianaClientException("invalid_response"); output.write(buffer,0,count) } }
+            safe { JSONObject(output.toString("UTF-8")) }
+        } catch (error: IndianaClientException) { throw error } catch (_: Exception) { throw IndianaClientException("temporary_unavailable") } finally { connection.disconnect() }
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/NativeStoreOffer.kt

@@ -0,0 +1,24 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+
+enum class IndianaNativeOfferKind(val value: String) { NONE("none"), INTRODUCTORY("introductory"), PROMOTIONAL("promotional") }
+
+/** Selected store terms are input evidence until the backend verifies the transaction. */
+data class IndianaNativeStoreOffer(val offerKind: IndianaNativeOfferKind, val offerId: String? = null, val discountMinor: Long = 0, val trialDays: Int? = null) {
+    init {
+        require(discountMinor in 0..100000000)
+        require(trialDays == null || trialDays in 1..730)
+        require(offerId == null || offerId.matches(Regex("[A-Za-z0-9][A-Za-z0-9._-]{0,254}")))
+        require(trialDays == null || discountMinor == 0L)
+        require(offerKind != IndianaNativeOfferKind.NONE || (offerId == null && discountMinor == 0L && trialDays == null))
+    }
+    internal fun wire(): JSONObject = JSONObject().put("offerKind", offerKind.value).put("offerId", offerId ?: JSONObject.NULL)
+        .put("discountMinor", discountMinor).put("trialDays", trialDays ?: JSONObject.NULL)
+    internal fun matches(provider: IndianaSubscriptionProvider): Boolean = when (provider) {
+        IndianaSubscriptionProvider.STRIPE -> false
+        IndianaSubscriptionProvider.APPLE -> (offerKind == IndianaNativeOfferKind.PROMOTIONAL) == (offerId != null)
+        IndianaSubscriptionProvider.GOOGLE -> (offerKind == IndianaNativeOfferKind.NONE) == (offerId == null) &&
+            (offerId == null || offerId.matches(Regex("[a-z0-9][a-z0-9-]*")))
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallContent.kt

@@ -0,0 +1,75 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+import java.security.MessageDigest
+
+/** Public immutable JSON only; the API's authenticated reply pins these exact bytes. */
+internal class IndianaPaywallContent(configuration: IndianaConfiguration) {
+    private val relay = IndianaFunnelConfigurationRelay(configuration)
+    suspend fun resolve(delivery: JSONObject): JSONObject {
+        IndianaSchema.validate("paywallDelivery", delivery)
+        val content = delivery.getJSONObject("content")
+        val artifact = content.getJSONObject("artifact")
+        val digest = artifact.getString("sha256")
+        val path = artifact.getString("url")
+        if (artifact.getString("kind") != "paywall" || artifact.getInt("formatVersion") != 1) throw IndianaClientException("invalid_response")
+        if (path != "/api/v1/configuration/${content.getString("environmentId")}/artifacts/$digest") throw IndianaClientException("invalid_response")
+        val reply = relay.read(JSONObject().put("path", path))
+        val bytes = reply.getString("body").toByteArray(Charsets.UTF_8)
+        if (reply.getInt("status") != 200 || !reply.getJSONObject("headers").optString("content-type").lowercase().startsWith("application/json")) throw IndianaClientException("invalid_response")
+        return hydrate(delivery, bytes)
+    }
+    companion object {
+        private val presentationFields = listOf("amountMinor", "interval", "intervalCount", "prepaid")
+        fun validatesHydration(loaded: JSONObject, delivery: JSONObject): Boolean {
+            val protected = JSONObject(loaded.toString()).apply { remove("document"); remove("offering") }
+            val plans = protected.getJSONObject("capabilities").getJSONObject("plans")
+            val original = delivery.getJSONObject("capabilities").getJSONObject("plans")
+            for (id in plans.keys()) {
+                val plan = plans.getJSONObject(id)
+                for (key in presentationFields) if (original.optJSONObject(id)?.has(key) != true) plan.remove(key)
+            }
+            return IndianaSchema.equal(protected, delivery)
+        }
+        fun applyPresentation(loaded: JSONObject, latest: JSONObject) {
+            latest.put("document", loaded.getJSONObject("document")).put("offering", loaded.getJSONObject("offering"))
+            val plans = latest.getJSONObject("capabilities").getJSONObject("plans")
+            val hydrated = loaded.getJSONObject("capabilities").getJSONObject("plans")
+            for (id in plans.keys()) {
+                val plan = plans.getJSONObject(id); val source = hydrated.optJSONObject(id) ?: continue
+                if (source.optString("currency") != plan.optString("currency")) continue
+                for (key in presentationFields) if (source.has(key)) plan.put(key, source.get(key))
+            }
+        }
+        fun hydrate(delivery: JSONObject, bytes: ByteArray): JSONObject {
+            IndianaSchema.validate("paywallDelivery", delivery)
+            val content = delivery.getJSONObject("content"); val artifact = content.getJSONObject("artifact")
+            val digest = artifact.getString("sha256")
+            if (artifact.getString("kind") != "paywall" || artifact.getInt("formatVersion") != 1) throw IndianaClientException("invalid_response")
+            val actual = MessageDigest.getInstance("SHA-256").digest(bytes).joinToString("") { "%02x".format(it) }
+            if (bytes.size != artifact.getInt("byteLength") || actual != digest) throw IndianaClientException("invalid_response")
+            val text = try { Charsets.UTF_8.newDecoder().onMalformedInput(java.nio.charset.CodingErrorAction.REPORT).decode(java.nio.ByteBuffer.wrap(bytes)).toString() }
+                catch (_: Exception) { throw IndianaClientException("invalid_response") }
+            val file = JSONObject(text); IndianaSchema.validate("publicPaywall", file)
+            if (file.getString("offeringVersionId") != content.getString("offeringVersionId")) throw IndianaClientException("invalid_response")
+            val document = JSONObject().put("schemaVersion", 3)
+            for (key in listOf("kind", "name", "presentation", "products", "offeringVersionId", "screen", "buttons")) document.put(key, file.get(key))
+            val result = JSONObject(delivery.toString()).put("document", document).put("offering", JSONObject().put("id", file.getString("offeringVersionId")))
+            val plans = result.getJSONObject("capabilities").getJSONObject("plans")
+            val catalog = file.getJSONObject("catalog")
+            for (id in catalog.keys()) {
+                val plan = plans.optJSONObject(id) ?: continue
+                val product = catalog.getJSONObject(id)
+                val prices = product.getJSONObject("channels").optJSONObject("stripe")?.optJSONArray("prices") ?: continue
+                for (index in 0 until prices.length()) {
+                    val price = prices.getJSONObject(index)
+                    if (price.getString("currency") != plan.optString("currency")) continue
+                    plan.put("amountMinor", price.get("amountMinor")).put("interval", product.get("interval")).put("intervalCount", product.get("intervalCount"))
+                    if (product.has("prepaid")) plan.put("prepaid", product.getJSONArray("prepaid"))
+                }
+            }
+            IndianaSchema.validate("paywallResolution", result)
+            return result
+        }
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallSession.kt

@@ -0,0 +1,144 @@
+package ai.tinkerland.indiana
+
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import org.json.JSONObject
+import org.json.JSONArray
+import java.net.URI
+import java.util.UUID
+import java.util.concurrent.atomic.AtomicReference
+
+/** Independent Paywall session; credentials and commercial authority stay in native/API code. */
+class IndianaPaywallSession internal constructor(
+    private val configuration: IndianaConfiguration, private val http: IndianaHTTP, customerToken: String,
+    paywallId: UUID?, versionId: UUID?, private val provider: IndianaSubscriptionProvider,
+    private val currency: String, private val locale: String,
+    private val content: suspend (JSONObject) -> JSONObject = IndianaPaywallContent(configuration)::resolve
+) {
+    private val token = AtomicReference<String?>(customerToken)
+    private val view = AtomicReference<JSONObject?>(null)
+    private val quoted = AtomicReference<JSONObject?>(null)
+    private val purchased = AtomicReference<JSONObject?>(null)
+    private val mutex = Mutex()
+    private var pendingPreview: String? = null
+    @Volatile private var invalidation: (() -> Unit)? = null
+    private val selector: JSONObject
+    init {
+        require((paywallId == null) != (versionId == null) && locale.length in 1..35 && currency.matches(Regex("[A-Z]{3}")))
+        selector = if (paywallId != null) JSONObject().put("type", "paywall").put("paywallId", paywallId.toString())
+        else JSONObject().put("type", "version").put("versionId", versionId.toString())
+    }
+    val current: JSONObject? get() = view.get()?.let { JSONObject(it.toString()) }
+    fun close() { token.set(null); view.set(null); quoted.set(null); purchased.set(null); invalidation?.invoke(); invalidation = null }
+    internal fun onInvalidation(callback: () -> Unit) { invalidation = callback; if (token.get() == null) callback() }
+    internal fun hostConfiguration() = configuration
+    internal fun hostInit() = JSONObject().put("event", "init").put("surface", "paywall")
+        .put("scope", JSONObject().put("projectId", configuration.scope.projectId.toString()).put("environment", configuration.scope.environment.value))
+        .put("apiOrigin", configuration.apiOrigin)
+    private suspend fun send(name: String, path: String, body: JSONObject): JSONObject {
+        val original = token.get() ?: throw IndianaClientException("identity_changed")
+        IndianaSchema.validate(name + "Request", body)
+        val result = try { http.send(path, "POST", original, body) } catch (e: Exception) {
+            if (token.get() != original) throw IndianaClientException("identity_changed"); throw e
+        }
+        if (token.get() != original) throw IndianaClientException("identity_changed")
+        IndianaSchema.validate(name + "Response", result)
+        if (safe { scope(result.getJSONObject("scope")) } != configuration.scope) throw IndianaClientException("scope_mismatch")
+        if (name == "resolvePaywall") {
+            result.put("paywall", content(result.getJSONObject("paywall")))
+            if (token.get() != original) throw IndianaClientException("identity_changed")
+        }
+        return result
+    }
+    suspend fun refresh(): JSONObject = hostCommand(JSONObject().put("operation", "resolve").put("input", JSONObject()))
+    internal suspend fun hostCommand(payload: JSONObject): JSONObject = mutex.withLock {
+        if (token.get() == null || payload.keys().asSequence().toSet() != setOf("operation", "input")) throw IndianaClientException("invalid_command")
+        val input = payload.getJSONObject("input")
+        when (val action = payload.getString("operation")) {
+            "resolve" -> {
+                if (input.length() != 0) throw IndianaClientException("invalid_command")
+                val prior = view.get()
+                val selected = prior?.let { JSONObject().put("type", "version").put("versionId", it.getString("id")) } ?: selector
+                val result = send("resolvePaywall", "paywalls/resolve", JSONObject().put("selector", selected)
+                    .put("commerce", JSONObject().put("provider", provider.value).put("currency", currency)).put("locale", locale)).getJSONObject("paywall")
+                val key = if (selector.getString("type") == "version") "id" else "paywallId"
+                if (result.getString(key) != selector.getString(if (key == "id") "versionId" else key) ||
+                    prior != null && (result.getString("id") != prior.getString("id") || result.getJSONObject("offering").getString("id") != prior.getJSONObject("offering").getString("id") || result.getJSONObject("content").getJSONObject("artifact").getString("sha256") != prior.getJSONObject("content").getJSONObject("artifact").getString("sha256")) ||
+                    result.getJSONObject("document").getString("offeringVersionId") != result.getJSONObject("offering").getString("id")) throw IndianaClientException("invalid_response")
+                view.set(result); JSONObject(result.toString())
+            }
+            "preview" -> {
+                if (!setOf("actionId", "productVersionId", "requestId", "offerId", "nativeOffer", "featureQuantities").containsAll(input.keys().asSequence().toSet())) throw IndianaClientException("invalid_command")
+                val product = input.getString("productVersionId")
+                val policy = view.get()?.getJSONObject("document")?.getJSONObject("buttons")?.optJSONObject(input.getString("actionId")) ?: throw IndianaClientException("invalid_command")
+                if (policy.optString("type") != "checkout") throw IndianaClientException("invalid_command")
+                val selection = policy.getJSONObject("product")
+                val allowed = if (selection.getString("type") == "fixed") selection.getString("productVersionId") == product
+                    else selection.getJSONArray("allowedProductVersionIds").let { ids -> (0 until ids.length()).any { ids.getString(it) == product } }
+                if (!allowed) throw IndianaClientException("invalid_command")
+                val fingerprint = canonical(payload)
+                if (pendingPreview != null && pendingPreview != fingerprint) {
+                    val status = purchased.get()?.optString("status")
+                    if (status == null || status == "pending") throw IndianaClientException("command_pending")
+                    quoted.set(null); purchased.set(null)
+                }
+                if (pendingPreview == fingerprint) quoted.get()?.let { return@withLock JSONObject(it.toString()) }
+                val selectedPlan = JSONObject().put("productVersionId", product)
+                if (input.has("featureQuantities")) selectedPlan.put("featureQuantities", input.getJSONObject("featureQuantities"))
+                val body = JSONObject().put("requestId", input.getString("requestId"))
+                    .put("plans", JSONArray().put(selectedPlan)).put("provider", provider.value).put("currency", currency)
+                for (key in listOf("offerId", "nativeOffer")) if (input.has(key)) body.put(key, input.get(key))
+                IndianaSchema.validate("previewAttachRequest", body)
+                pendingPreview = fingerprint
+                val result = send("previewAttach", "subscriptions/preview-attach", body).getJSONObject("quote")
+                if (result.getString("provider") != provider.value || result.getString("currency") != currency || result.getJSONArray("lines").length() != 1 || result.getJSONArray("lines").getJSONObject(0).getString("productVersionId") != product) throw IndianaClientException("invalid_response")
+                quoted.set(result); purchased.set(null); JSONObject(result.toString())
+            }
+            "confirm", "cancel", "read" -> {
+                if (input.length() != 0) throw IndianaClientException("invalid_command")
+                val id = quoted.get()?.getString("operationId") ?: throw IndianaClientException("invalid_command")
+                val body = JSONObject().put("operationId", id)
+                if (action != "read") body.put("intent", action)
+                val result = send(if (action == "read") "readSubscriptionOperation" else "attach",
+                    if (action == "read") "subscriptions/operations/read" else "subscriptions/attach", body).getJSONObject("operation")
+                if (result.getString("operationId") != id || result.getString("currency") != currency) throw IndianaClientException("invalid_response")
+                purchased.get()?.takeIf { it.getString("status") == "complete" }?.let { return@withLock JSONObject(it.toString()) }
+                purchased.set(result)
+                if (result.getString("status") !in setOf("pending", "complete")) { pendingPreview = null; quoted.set(null) }
+                JSONObject(result.toString())
+            }
+            else -> throw IndianaClientException("invalid_command")
+        }
+    }
+    internal fun trustedPurchase(value: JSONObject): JSONObject {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || saved.optString("status") != "pending" || canonical(value) != canonical(saved)) throw IndianaClientException("invalid_command")
+        return JSONObject(saved.toString())
+    }
+    internal fun trustedCheckout(value: String): URI {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        val url = URI(value)
+        if (token.get() == null || saved.optString("status") != "pending" || saved.optString("checkoutUrl") != value || url.scheme != "https" || url.userInfo != null) throw IndianaClientException("invalid_command")
+        return url
+    }
+    internal fun trustedAction(value: String, type: String): String {
+        val buttons = view.get()?.getJSONObject("document")?.getJSONObject("buttons") ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || !buttons.keys().asSequence().any { key ->
+            val policy = buttons.getJSONObject(key); val action = policy.optJSONObject("action")
+            policy.optString("type") == "action" && action?.optString("type") == type && action.optString(if (type == "event") "event" else "url") == value
+        }) throw IndianaClientException("invalid_command")
+        return value
+    }
+    internal fun completedOperation(): JSONObject {
+        val saved = purchased.get() ?: throw IndianaClientException("invalid_command")
+        if (token.get() == null || saved.optString("status") != "complete") throw IndianaClientException("invalid_command")
+        return JSONObject(saved.toString())
+    }
+    private fun canonical(value: Any?): String = when(value) {
+        is JSONObject -> value.keys().asSequence().sorted().joinToString(",", "{", "}") { JSONObject.quote(it) + ":" + canonical(value.get(it)) }
+        is JSONArray -> (0 until value.length()).joinToString(",", "[", "]") { canonical(value.get(it)) }
+        is String -> JSONObject.quote(value)
+        null, JSONObject.NULL -> "null"
+        else -> value.toString()
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/PaywallView.kt

@@ -0,0 +1,74 @@
+package ai.tinkerland.indiana
+
+import android.app.Activity
+import android.content.Intent
+import android.graphics.Color
+import android.net.Uri
+import android.widget.FrameLayout
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import org.json.JSONObject
+import java.net.URI
+
+/** Independent Paywall using exactly the same packaged renderer as Funnel. */
+class IndianaPaywallView(private val activity: Activity, val session: IndianaPaywallSession): FrameLayout(activity) {
+    var onPurchase: (suspend (JSONObject) -> Unit)? = null
+    var onEvent: (suspend (String) -> Unit)? = null
+    var onOpenUrl: (suspend (URI) -> Unit)? = null
+    var onComplete: ((JSONObject) -> Unit)? = null
+    var onDismiss: (() -> Unit)? = null
+    var onError: ((Exception) -> Unit)? = null
+    private val work = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
+    private var stopped = false; private var dismissed = false
+    private val completions = mutableSetOf<String>()
+    private val host = IndianaBundledWebView(activity, "Paywall", work, ::dispatch) { onError?.invoke(it) }
+    init {
+        setBackgroundColor(Color.TRANSPARENT)
+        addView(host.view, LayoutParams(LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT))
+        session.onInvalidation { post { destroy() } }
+        host.start()
+    }
+    private suspend fun dispatch(method: String, raw: Any?): Any? = when (method) {
+        "ready" -> { host.send(session.hostInit()); null }
+        "paywall" -> session.hostCommand(raw as? JSONObject ?: throw IndianaClientException("invalid_command"))
+        "purchase" -> {
+            val value = (raw as? JSONObject)?.optJSONObject("operation") ?: throw IndianaClientException("invalid_command")
+            val trusted = session.trustedPurchase(value)
+            val callback = onPurchase ?: throw IndianaClientException("unsupported_capability")
+            callback(trusted); null
+        }
+        "checkout" -> {
+            val value = (raw as? JSONObject)?.optString("url") ?: throw IndianaClientException("invalid_command")
+            open(session.trustedCheckout(value)); null
+        }
+        "open" -> {
+            val value = (raw as? JSONObject)?.optString("url") ?: throw IndianaClientException("invalid_command")
+            val url = URI(session.trustedAction(value, "open_url"))
+            if (url.scheme != "https") throw IndianaClientException("invalid_command")
+            val callback = onOpenUrl
+            if (callback != null) callback(url) else open(url)
+            null
+        }
+        "event" -> {
+            val value = (raw as? JSONObject)?.optString("event") ?: throw IndianaClientException("invalid_command")
+            val trusted = session.trustedAction(value, "event")
+            val callback = onEvent ?: throw IndianaClientException("unsupported_capability")
+            callback(trusted); null
+        }
+        "complete" -> { val result = session.completedOperation(); if (completions.add(result.getString("operationId"))) { onComplete?.invoke(result) }; null }
+        "dismiss" -> { close(); null }
+        "error" -> { onError?.invoke(IndianaClientException("renderer_failed")); null }
+        else -> throw IndianaClientException("invalid_command")
+    }
+    private fun open(url: URI) { activity.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url.toString())).addCategory(Intent.CATEGORY_BROWSABLE)) }
+    fun refresh() { host.event("refresh") }
+    override fun onWindowFocusChanged(hasWindowFocus: Boolean) { super.onWindowFocusChanged(hasWindowFocus); if (hasWindowFocus) refresh() }
+    fun destroy() {
+        if (stopped) return
+        stopped = true; host.destroy(); work.cancel(); removeView(host.view); session.close()
+        if (!dismissed) { dismissed = true; onDismiss?.invoke() }
+    }
+    fun close() { destroy() }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/Protocol.kt

@@ -0,0 +1,28 @@
+package ai.tinkerland.indiana
+
+import org.json.JSONObject
+import java.util.UUID
+import java.text.SimpleDateFormat
+import java.util.Locale
+import java.util.TimeZone
+
+data class IndianaScope(val projectId: UUID, val environment: IndianaEnvironment)
+class IndianaClientException(val code: String): Exception(code)
+internal fun uuid(value: String): UUID { require(IndianaProtocol.uuidPattern.matches(value));val id=UUID.fromString(value);require(id.toString()==value.lowercase(Locale.ROOT));return id }
+internal fun text(raw: JSONObject,key: String): String {val value=raw.get(key);require(value is String);return value}
+internal fun keys(raw: JSONObject, expected: Set<String>) { require(raw.keys().asSequence().toSet()==expected) }
+internal fun fields(raw: JSONObject, allowed: Set<String>, required: Set<String>) { val actual=raw.keys().asSequence().toSet(); require(allowed.containsAll(actual) && actual.containsAll(required)) }
+internal fun scope(raw: JSONObject): IndianaScope = safe {
+    keys(raw,IndianaProtocol.scopeKeys);IndianaScope(uuid(text(raw,"projectId")),IndianaEnvironment.entries.single {it.value==text(raw,"environment")})
+}
+internal fun utcMillis(value: String): Long = safe {
+    require(IndianaProtocol.utcPattern.matches(value))
+    val match=Regex("^(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})(?:\\.(\\d+))?(Z|[+-]\\d{2}:\\d{2})$").matchEntire(value) ?: throw IllegalArgumentException()
+    val formatter=SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss",Locale.ROOT).apply {isLenient=false;timeZone=TimeZone.getTimeZone("UTC")}
+    val date=formatter.parse(match.groupValues[1]) ?: throw IllegalArgumentException()
+    val offset = match.groupValues[3]
+    val offsetMillis = if(offset == "Z") 0L else ((offset.substring(1,3).toLong()*60 + offset.substring(4,6).toLong())*60_000) * if(offset[0] == '+') 1 else -1
+    date.time+match.groupValues[2].padEnd(3,'0').take(3).toLong()-offsetMillis
+}
+internal inline fun <T> safe(block:()->T): T = try{block()}catch(e:IndianaClientException){throw e}catch(_:Exception){throw IndianaClientException("invalid_response")}
+

package/native-sdk/android/java/ai/tinkerland/indiana/PushInstallation.kt

@@ -0,0 +1,170 @@
+package ai.tinkerland.indiana
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.AtomicFile
+import android.util.Base64
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.File
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.MessageDigest
+import java.security.Signature
+import java.security.spec.ECGenParameterSpec
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+import java.util.TimeZone
+import java.util.UUID
+
+enum class IndianaPushPermission(val value: String) { UNKNOWN("unknown"), DENIED("denied"), PROVISIONAL("provisional"), GRANTED("granted") }
+enum class IndianaPushAddressKind(val value: String) { APNS_TOKEN("apns_token"), FCM_TOKEN("fcm_token") }
+data class IndianaPushObservation(val connectionId: UUID?, val kind: IndianaPushAddressKind?, val token: String?, val permission: IndianaPushPermission) {
+    init {
+        require((connectionId == null && kind == null && token == null) || (connectionId != null && kind != null && token != null && token.length in 16..4096 && token.all { it.code in 33..126 }))
+    }
+}
+class IndianaPushObservationTicket internal constructor(internal val client: UUID, internal val identity: UUID, internal val observation: UUID)
+internal const val PUSH_MAX_SEQUENCE = 9_007_199_254_740_991L
+internal fun pushSigningBytes(fields: JSONArray): ByteArray {
+    fun quoted(value: String) = buildString {
+        append('"')
+        for (character in value) when (character) {
+            '"' -> append("\\\"")
+            '\\' -> append("\\\\")
+            else -> { require(character.code in 32..126); append(character) }
+        }
+        append('"')
+    }
+    return (0 until fields.length()).joinToString(",", "[", "]") { index ->
+        when (val value = fields.get(index)) {
+            JSONObject.NULL -> "null"
+            is String -> quoted(value)
+            is Long -> value.toString()
+            is Int -> value.toString()
+            else -> throw IndianaClientException("invalid_configuration")
+        }
+    }.toByteArray(Charsets.UTF_8)
+}
+internal data class IndianaPushJournal(val installationId: UUID, val publicKey: String, val identitySeq: Long = 0, val addressSeq: Long = 0, val detachSeq: Long? = null) {
+    fun validate() {
+        if (identitySeq !in 0..PUSH_MAX_SEQUENCE || addressSeq !in 0..PUSH_MAX_SEQUENCE || (detachSeq != null && detachSeq !in 1..identitySeq) || !publicKey.matches(Regex("[A-Za-z0-9_-]{80,200}"))) throw IndianaClientException("protected_storage_unavailable")
+    }
+}
+internal interface IndianaPushStorage {
+    /** Commits before returning; no Customer credential or provider token is stored. */
+    fun transaction(update: (IndianaPushJournal) -> IndianaPushJournal): IndianaPushJournal
+    fun sign(payload: ByteArray): String
+}
+internal fun pushP1363(der: ByteArray): ByteArray {
+    if (der.size !in 8..72 || der[0].toInt() != 0x30 || (der[1].toInt() and 255) != der.size - 2) throw IndianaClientException("protected_storage_unavailable")
+    var offset = 2
+    val result = ByteArray(64)
+    for (part in 0..1) {
+        if (offset + 2 > der.size || der[offset++].toInt() != 2) throw IndianaClientException("protected_storage_unavailable")
+        val size = der[offset++].toInt() and 255
+        if (size !in 1..33 || offset + size > der.size || der[offset].toInt() < 0) throw IndianaClientException("protected_storage_unavailable")
+        val leading = if (size > 1 && der[offset].toInt() == 0) 1 else 0
+        if (size - leading > 32) throw IndianaClientException("protected_storage_unavailable")
+        der.copyInto(result, part * 32 + 32 - size + leading, offset + leading, offset + size); offset += size
+    }
+    if (offset != der.size) throw IndianaClientException("protected_storage_unavailable")
+    return result
+}
+/** Key stays in Android Keystore; the atomic journal stays in App-private no-backup storage. */
+internal class IndianaPushKeystore(context: Context, scope: IndianaScope): IndianaPushStorage {
+    private val namespace = "${context.packageName}:${scope.projectId}:${scope.environment.value}"
+    private val hash = MessageDigest.getInstance("SHA-256").digest(namespace.toByteArray()).joinToString("") { "%02x".format(it) }
+    private val alias = "indiana.push.v1.$hash"
+    private val file = AtomicFile(File(context.noBackupFilesDir, "indiana-push-$hash.json"))
+    companion object { private val lock = Any() }
+    private fun store(): KeyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+    private fun base64(bytes: ByteArray) = Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING)
+    override fun transaction(update: (IndianaPushJournal) -> IndianaPushJournal): IndianaPushJournal = synchronized(lock) {
+        try {
+            val keystore = store()
+            val current = if (!file.baseFile.exists()) {
+                if (keystore.containsAlias(alias)) throw IndianaClientException("protected_storage_unavailable")
+                val spec = KeyGenParameterSpec.Builder(alias, KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY).setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1")).setDigests(KeyProperties.DIGEST_SHA256).build()
+                val key = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore").apply { initialize(spec) }.generateKeyPair()
+                IndianaPushJournal(UUID.randomUUID(), base64(key.public.encoded))
+            } else {
+                val bytes = file.openRead().use { input ->
+                    val output = java.io.ByteArrayOutputStream(); val buffer = ByteArray(1024)
+                    while (true) { val count = input.read(buffer); if (count < 0) break; if (output.size() + count > 4096) throw IndianaClientException("protected_storage_unavailable"); output.write(buffer, 0, count) }
+                    output.toByteArray()
+                }
+                if (bytes.size > 4096) throw IndianaClientException("protected_storage_unavailable")
+                val json = JSONObject(bytes.toString(Charsets.UTF_8))
+                if (json.keys().asSequence().toSet() != setOf("installationId", "publicKey", "identitySeq", "addressSeq", "detachSeq")) throw IndianaClientException("protected_storage_unavailable")
+                IndianaPushJournal(UUID.fromString(json.getString("installationId")), json.getString("publicKey"), json.getLong("identitySeq"), json.getLong("addressSeq"), if (json.isNull("detachSeq")) null else json.getLong("detachSeq"))
+            }
+            current.validate()
+            if (base64(keystore.getCertificate(alias)?.publicKey?.encoded ?: throw IndianaClientException("protected_storage_unavailable")) != current.publicKey) throw IndianaClientException("protected_storage_unavailable")
+            val next = update(current); next.validate()
+            if (next.installationId != current.installationId || next.publicKey != current.publicKey || next.identitySeq < current.identitySeq || next.addressSeq < current.addressSeq) throw IndianaClientException("protected_storage_unavailable")
+            if (!file.baseFile.exists() || next != current) {
+                val data = JSONObject().put("installationId", next.installationId.toString()).put("publicKey", next.publicKey).put("identitySeq", next.identitySeq).put("addressSeq", next.addressSeq).put("detachSeq", next.detachSeq ?: JSONObject.NULL).toString().toByteArray()
+                val stream = file.startWrite()
+                try { stream.write(data); file.finishWrite(stream) } catch (error: Exception) { file.failWrite(stream); throw error }
+            }
+            next
+        } catch (_: Exception) { throw IndianaClientException("protected_storage_unavailable") }
+    }
+    override fun sign(payload: ByteArray): String = synchronized(lock) {
+        try {
+            val key = store().getKey(alias, null) as? java.security.PrivateKey ?: throw IndianaClientException("protected_storage_unavailable")
+            val signature = Signature.getInstance("SHA256withECDSA").apply { initSign(key); update(payload) }.sign()
+            base64(pushP1363(signature))
+        } catch (_: Exception) { throw IndianaClientException("protected_storage_unavailable") }
+    }
+}
+internal class IndianaPushIdentity(val storage: IndianaPushStorage) {
+    init { state() }
+    fun state() = storage.transaction { it }
+    fun reserve(detach: Boolean = false): Long = storage.transaction { current ->
+        if (current.identitySeq >= PUSH_MAX_SEQUENCE) throw IndianaClientException("protected_storage_unavailable")
+        val next = current.identitySeq + 1
+        current.copy(identitySeq = next, detachSeq = if (detach) next else current.detachSeq)
+    }.identitySeq
+    fun reserveAddress(): Long = storage.transaction { current ->
+        if (current.addressSeq >= PUSH_MAX_SEQUENCE) throw IndianaClientException("protected_storage_unavailable")
+        current.copy(addressSeq = current.addressSeq + 1)
+    }.addressSeq
+    fun clearDetach(sequence: Long) { storage.transaction { if (it.detachSeq == sequence) it.copy(detachSeq = null) else it } }
+    fun recover(remote: JSONObject, expected: Long): Long = storage.transaction { current ->
+        if (current.identitySeq != expected) throw IndianaClientException("identity_changed")
+        val floor = maxOf(current.identitySeq, remote.getLong("identitySeq"))
+        if (floor >= PUSH_MAX_SEQUENCE) throw IndianaClientException("protected_storage_unavailable")
+        current.copy(identitySeq = floor + 1, addressSeq = maxOf(current.addressSeq, remote.getLong("addressSeq")))
+    }.identitySeq
+    fun command(operation: String, scope: IndianaScope, sequence: Long? = null, credential: String? = null, observation: IndianaPushObservation? = null, challenge: String? = null): JSONObject {
+        val state = state(); val issued = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", Locale.US).apply { timeZone = TimeZone.getTimeZone("UTC") }.format(Date())
+        val fields = JSONArray().put("indiana_push_v1").put(operation).put(scope.projectId.toString()).put(scope.environment.value).put(state.installationId.toString()).put(state.publicKey).put(issued)
+        val input = JSONObject().put("installationId", state.installationId.toString()).put("publicKey", state.publicKey).put("issuedAt", issued)
+        fun digest(): String = MessageDigest.getInstance("SHA-256").digest((credential ?: throw IndianaClientException("unauthenticated")).toByteArray()).joinToString("") { "%02x".format(it) }
+        when (operation) {
+            "bind", "detach" -> {
+                require(sequence != null); fields.put(sequence).put("android"); input.put("sequence", sequence).put("platform", "android")
+                if (operation == "bind") { val digest = digest(); fields.put(digest); input.put("credentialDigest", digest) }
+            }
+            "read" -> { val digest = digest(); fields.put(digest); input.put("credentialDigest", digest) }
+            "address", "recovery_request", "recovery_confirm" -> {
+                require(sequence != null && observation != null); val digest = digest()
+                val connection = observation.connectionId?.toString() ?: JSONObject.NULL; val kind = observation.kind?.value ?: JSONObject.NULL; val token = observation.token ?: JSONObject.NULL
+                fields.put(sequence).put(digest).put(connection).put(kind).put(token).put(observation.permission.value)
+                input.put("sequence", sequence).put("credentialDigest", digest).put("connectionId", connection).put("kind", kind).put("token", token).put("permission", observation.permission.value)
+                if (operation == "recovery_confirm") {
+                    if (challenge == null || !challenge.matches(Regex("[A-Za-z0-9_-]{100,3500}"))) throw IndianaClientException("invalid_configuration")
+                    fields.put(challenge); input.put("challenge", challenge)
+                }
+            }
+            else -> throw IndianaClientException("invalid_configuration")
+        }
+        input.put("signature", storage.sign(pushSigningBytes(fields)))
+        if (operation == "detach") input.put("projectId", scope.projectId.toString()).put("environment", scope.environment.value)
+        return input
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/RendererNavigation.kt

@@ -0,0 +1,13 @@
+package ai.tinkerland.indiana
+
+import java.net.URI
+
+private object BundledRenderer {
+    val url: String by lazy {
+        checkNotNull(BundledRenderer::class.java.getResourceAsStream("/renderer-data-url.txt"))
+            .bufferedReader(Charsets.UTF_8).use { it.readText() }
+    }
+}
+/** Subframes can execute only the renderer bytes shipped with this SDK. */
+internal fun allowsFunnelRendererNavigation(offered: URI, base: URI): Boolean =
+    base.toString() == "https://indiana-sdk.invalid/" && offered.toString().substringBefore('#') == BundledRenderer.url

package/native-sdk/android/java/ai/tinkerland/indiana/SDKVersion.kt

@@ -0,0 +1,6 @@
+// Generated by scripts/sdk/generate-native-protocol.mjs. Do not edit.
+package ai.tinkerland.indiana
+
+object IndianaSDK {
+    const val version = "0.9.5"
+}

package/native-sdk/android/java/ai/tinkerland/indiana/StoreSubscriptionManagement.kt

@@ -0,0 +1,19 @@
+package ai.tinkerland.indiana
+
+import android.app.Activity
+import android.content.Intent
+import android.net.Uri
+
+/** Opens Play's renewal management. Returning to the App never proves an entitlement change. */
+object IndianaStoreSubscriptions {
+    fun manage(activity: Activity, productId: String) {
+        val url = managementURL(activity.packageName, productId)
+        activity.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)))
+    }
+
+    internal fun managementURL(packageName: String, productId: String): String {
+        require(packageName.matches(Regex("[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+"))) { "invalid_app_package" }
+        require(productId.length in 1..255 && productId.matches(Regex("[a-z0-9][a-z0-9._]*"))) { "invalid_store_product" }
+        return "https://play.google.com/store/account/subscriptions?sku=$productId&package=$packageName"
+    }
+}