@tinkerlandai/indiana-react-native 0.9.2 → 0.9.5

package/native-sdk/ios/NativePendingKeychain.swift

@@ -0,0 +1,52 @@
+import Foundation
+import Security
+
+struct IndianaNativePendingOrder: Codable, Sendable, Equatable {
+    let runId: UUID; let orderId: UUID; let receiptId: UUID; let productId: String; let accountToken: UUID
+}
+/// Stores only current order bindings; never a run token, customer token or JWS.
+protocol IndianaNativePendingStorage: Sendable {
+    func read(_ order: UUID) async throws -> IndianaNativePendingOrder?
+    func orders() async throws -> [IndianaNativePendingOrder]
+    func orders(runId: UUID) async throws -> [IndianaNativePendingOrder]
+    func contains(_ record: IndianaNativePendingOrder) async throws -> Bool
+    func put(_ record: IndianaNativePendingOrder) async throws
+    func remove(_ order: UUID) async throws
+}
+actor IndianaNativePendingKeychain: IndianaNativePendingStorage {
+    private let service: String
+    init(scope: IndianaScope) { service = "\(Bundle.main.bundleIdentifier ?? "Indiana").grow.funnel.orders.v1.\(scope.projectId.uuidString.lowercased()).\(scope.environment.rawValue)" }
+    private func query(_ order: UUID) -> [String: Any] { [kSecClass as String:kSecClassGenericPassword,kSecAttrService as String:service,kSecAttrAccount as String:order.uuidString.lowercased()] }
+    func read(_ order: UUID) throws -> IndianaNativePendingOrder? {
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query(order).merging([kSecReturnData as String:true]) { _, new in new } as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data, data.count <= 4096, let original = try? JSONDecoder().decode(IndianaNativePendingOrder.self, from: data), original.orderId == order else { throw IndianaClientError.protectedStorageUnavailable }
+        return original
+    }
+    private func allOrders() throws -> [IndianaNativePendingOrder] {
+        let query: [String: Any] = [kSecClass as String:kSecClassGenericPassword,kSecAttrService as String:service,kSecReturnData as String:true,kSecMatchLimit as String:kSecMatchLimitAll]
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound { return [] }
+        guard status == errSecSuccess, let bytes = result as? [Data], bytes.count <= 100 else { throw IndianaClientError.protectedStorageUnavailable }
+        return try bytes.map { data in
+            guard data.count <= 4096 else { throw IndianaClientError.protectedStorageUnavailable }
+            return try JSONDecoder().decode(IndianaNativePendingOrder.self, from: data)
+        }
+    }
+    func orders() throws -> [IndianaNativePendingOrder] { try allOrders() }
+    func orders(runId: UUID) throws -> [IndianaNativePendingOrder] { try allOrders().filter { $0.runId == runId } }
+    func contains(_ record: IndianaNativePendingOrder) throws -> Bool {
+        guard let original = try read(record.orderId) else { return false }; guard original == record else { throw IndianaClientError.protectedStorageUnavailable }; return true
+    }
+    func put(_ record: IndianaNativePendingOrder) throws {
+        if try contains(record) { return }
+        guard try allOrders().count < 100 else { throw IndianaClientError.protectedStorageUnavailable }
+        let bytes = try JSONEncoder().encode(record)
+        let status = SecItemAdd(query(record.orderId).merging([kSecValueData as String:bytes,kSecAttrAccessible as String:kSecAttrAccessibleWhenUnlockedThisDeviceOnly]) { _, new in new } as CFDictionary, nil)
+        if status == errSecDuplicateItem { guard try contains(record) else { throw IndianaClientError.protectedStorageUnavailable }; return }
+        guard status == errSecSuccess else { throw IndianaClientError.protectedStorageUnavailable }
+    }
+    func remove(_ order: UUID) throws { let status = SecItemDelete(query(order) as CFDictionary); guard status == errSecSuccess || status == errSecItemNotFound else { throw IndianaClientError.protectedStorageUnavailable } }
+}

package/native-sdk/ios/NativeReceiptRelay.swift

@@ -0,0 +1,28 @@
+import Foundation
+
+struct IndianaNativeCompletion: Codable, Sendable { let orderId: UUID; let receiptId: UUID; let membership: Bool; let transactionIds: [String] }
+
+/// HTTPS endpoint on your own backend. It authenticates the customer and attaches the Indiana server key there.
+public final class IndianaNativeReceiptRelay: Sendable {
+    private let endpoint: URL; private let session: URLSession
+    public init(endpoint: URL) throws {
+        guard endpoint.scheme == "https", endpoint.host != nil, endpoint.user == nil, endpoint.password == nil, endpoint.query == nil, endpoint.fragment == nil else { throw IndianaClientError.invalidConfiguration }
+        self.endpoint = endpoint
+        let config = URLSessionConfiguration.ephemeral; config.urlCache = nil; config.httpCookieStorage = nil; config.requestCachePolicy = .reloadIgnoringLocalCacheData; config.timeoutIntervalForRequest = 35
+        session = URLSession(configuration: config, delegate: NoRedirect(), delegateQueue: nil)
+    }
+    public func send(_ body: Data) async throws -> Data {
+        guard body.count <= 262144, let input = try? JSONDecoder().decode(IndianaJSON.self, from: body).object, input["operation"] == .string("native_receipt"), let token = input["customerToken"]?.string, token.range(of: "^gg_ct_[A-Za-z0-9_-]{32,128}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidConfiguration }
+        var request = URLRequest(url: endpoint); request.httpMethod = "POST"; request.httpBody = body
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type"); request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        do {
+            let (stream, response) = try await session.bytes(for: request)
+            guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else { throw IndianaClientError.requestFailed((response as? HTTPURLResponse)?.statusCode ?? 0) }
+            guard response.expectedContentLength <= 262144 else { throw IndianaClientError.invalidResponse }
+            var result = Data(); for try await byte in stream { guard result.count < 262144 else { throw IndianaClientError.invalidResponse }; result.append(byte) }; return result
+        } catch let error as IndianaClientError { throw error } catch { throw IndianaClientError.temporaryUnavailable }
+    }
+    private final class NoRedirect: NSObject, URLSessionTaskDelegate, Sendable {
+        func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) { completionHandler(nil) }
+    }
+}

package/native-sdk/ios/NativeStoreOffer.swift

@@ -0,0 +1,34 @@
+import Foundation
+
+public enum IndianaNativeOfferKind: String, Sendable { case none, introductory, promotional }
+
+/// The selected store quote belongs to this purchase, not the reusable SKU binding.
+public struct IndianaNativeStoreOffer: Sendable {
+    public let offerKind: IndianaNativeOfferKind
+    public let offerID: String?
+    public let discountMinor: Int
+    public let trialDays: Int?
+
+    public init(offerKind: IndianaNativeOfferKind, offerID: String? = nil, discountMinor: Int = 0, trialDays: Int? = nil) throws {
+        guard (0...100000000).contains(discountMinor), trialDays == nil || (1...730).contains(trialDays!),
+              offerID == nil || offerID!.range(of: "^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$", options: .regularExpression) != nil,
+              trialDays == nil || discountMinor == 0,
+              offerKind != .none || (offerID == nil && discountMinor == 0 && trialDays == nil) else { throw IndianaClientError.invalidResponse }
+        self.offerKind = offerKind; self.offerID = offerID; self.discountMinor = discountMinor; self.trialDays = trialDays
+    }
+
+    var wire: IndianaJSON { .object([
+        "offerKind": .string(offerKind.rawValue), "offerId": offerID.map(IndianaJSON.string) ?? .null,
+        "discountMinor": .number(Double(discountMinor)), "trialDays": trialDays.map { .number(Double($0)) } ?? .null
+    ]) }
+
+    func matches(_ provider: IndianaSubscriptionProvider) -> Bool {
+        switch provider {
+        case .stripe: return false
+        case .apple: return (offerKind == .promotional) == (offerID != nil)
+        case .google:
+            return (offerKind == .none) == (offerID == nil) &&
+                (offerID == nil || offerID!.range(of: "^[a-z0-9][a-z0-9-]*$", options: .regularExpression) != nil)
+        }
+    }
+}

package/native-sdk/ios/PaywallContent.swift

@@ -0,0 +1,75 @@
+import Foundation
+import CryptoKit
+
+/// Only immutable JSON crosses this public transport. Business credentials never enter it.
+final class IndianaPaywallContent: Sendable {
+    private static let presentationFields = ["amountMinor", "interval", "intervalCount", "prepaid"]
+    /// Hydration may add catalog presentation fields, but cannot change authenticated delivery facts.
+    static func validatesHydration(_ loaded: [String: IndianaJSON], delivery: [String: IndianaJSON]) -> Bool {
+        var protected = loaded.filter { !["document", "offering"].contains($0.key) }
+        if var capabilities = protected["capabilities"]?.object, var plans = capabilities["plans"]?.object {
+            let original = delivery["capabilities"]?.object?["plans"]?.object ?? [:]
+            for (id, entry) in plans {
+                guard var plan = entry.object else { return false }
+                for key in presentationFields where original[id]?.object?[key] == nil { plan.removeValue(forKey: key) }
+                plans[id] = .object(plan)
+            }
+            capabilities["plans"] = .object(plans); protected["capabilities"] = .object(capabilities)
+        }
+        return protected == delivery
+    }
+    static func applyPresentation(_ loaded: [String: IndianaJSON], to latest: inout [String: IndianaJSON]) {
+        latest["document"] = loaded["document"]; latest["offering"] = loaded["offering"]
+        guard var capabilities = latest["capabilities"]?.object, var plans = capabilities["plans"]?.object,
+              let hydrated = loaded["capabilities"]?.object?["plans"]?.object else { return }
+        for (id, entry) in plans {
+            guard var plan = entry.object, let source = hydrated[id]?.object, source["currency"] == plan["currency"] else { continue }
+            for key in presentationFields where source[key] != nil { plan[key] = source[key] }
+            plans[id] = .object(plan)
+        }
+        capabilities["plans"] = .object(plans); latest["capabilities"] = .object(capabilities)
+    }
+    private let relay: IndianaFunnelConfigurationRelay
+    init(configuration: IndianaConfiguration) { relay = IndianaFunnelConfigurationRelay(configuration: configuration) }
+    func resolve(_ delivery: IndianaJSON) async throws -> IndianaJSON {
+        try IndianaSchema.validate("paywallDelivery", data: JSONEncoder().encode(delivery))
+        guard let value = delivery.object, let content = value["content"]?.object,
+              let environment = content["environmentId"]?.string, let artifact = content["artifact"]?.object,
+              let digest = artifact["sha256"]?.string, let path = artifact["url"]?.string,
+              artifact["kind"] == .string("paywall"), artifact["formatVersion"] == .number(1),
+              path == "/api/v1/configuration/\(environment)/artifacts/\(digest)",
+              artifact["byteLength"] != nil else { throw IndianaClientError.invalidResponse }
+        let reply = try await relay.read(.object(["path": .string(path)]))
+        guard reply.object?["status"] == .number(200),
+              let type = reply.object?["headers"]?.object?["content-type"]?.string, type.lowercased().hasPrefix("application/json"),
+              let text = reply.object?["body"]?.string, let data = text.data(using: .utf8) else { throw IndianaClientError.invalidResponse }
+        return try Self.hydrate(delivery, bytes: data)
+    }
+    static func hydrate(_ delivery: IndianaJSON, bytes data: Data) throws -> IndianaJSON {
+        try IndianaSchema.validate("paywallDelivery", data: JSONEncoder().encode(delivery))
+        guard var value = delivery.object, let content = value["content"]?.object, let artifact = content["artifact"]?.object,
+              artifact["kind"] == .string("paywall"), artifact["formatVersion"] == .number(1),
+              let digest = artifact["sha256"]?.string, case .number(let expected) = artifact["byteLength"], data.count == Int(expected),
+              SHA256.hash(data: data).map({ String(format: "%02x", $0) }).joined() == digest else { throw IndianaClientError.invalidResponse }
+        try IndianaSchema.validate("publicPaywall", data: data)
+        guard let file = try JSONDecoder().decode(IndianaJSON.self, from: data).object,
+              file["offeringVersionId"] == content["offeringVersionId"] else { throw IndianaClientError.invalidResponse }
+        let keys: Set<String> = ["kind", "name", "presentation", "products", "offeringVersionId", "screen", "buttons"]
+        var document = file.filter { keys.contains($0.key) }; document["schemaVersion"] = .number(3)
+        value["document"] = .object(document); value["offering"] = .object(["id": file["offeringVersionId"]!])
+        if var capabilities = value["capabilities"]?.object, var plans = capabilities["plans"]?.object, let catalog = file["catalog"]?.object {
+            for (id, entry) in catalog {
+                guard var plan = plans[id]?.object, let product = entry.object,
+                      let currency = plan["currency"]?.string,
+                      case .array(let prices) = product["channels"]?.object?["stripe"]?.object?["prices"],
+                      let price = prices.first(where: { $0.object?["currency"]?.string == currency })?.object else { continue }
+                plan["amountMinor"] = price["amountMinor"]; plan["interval"] = product["interval"]; plan["intervalCount"] = product["intervalCount"]
+                plan["prepaid"] = product["prepaid"]; plans[id] = .object(plan)
+            }
+            capabilities["plans"] = .object(plans); value["capabilities"] = .object(capabilities)
+        }
+        let hydrated = IndianaJSON.object(value)
+        try IndianaSchema.validate("paywallResolution", data: JSONEncoder().encode(hydrated))
+        return hydrated
+    }
+}

package/native-sdk/ios/PaywallSession.swift

@@ -0,0 +1,124 @@
+import Foundation
+
+/// Independent Paywall identity and commercial state. No Funnel or browser credential is created.
+public actor IndianaPaywallSession {
+    private let configuration: IndianaConfiguration
+    private let http: any IndianaHTTP
+    private let content: @Sendable (IndianaJSON) async throws -> IndianaJSON
+    private var token: String?
+    private let selector: IndianaJSON
+    private let provider: IndianaSubscriptionProvider
+    private let currency: String
+    private let locale: String
+    private var busy = false
+    private var closed = false
+    private var invalidation: (@Sendable () -> Void)?
+    private var pendingPreview: Data?
+    private var quote: IndianaJSON?
+    private var operation: IndianaJSON?
+    public private(set) var current: IndianaJSON?
+
+    init(configuration: IndianaConfiguration, http: any IndianaHTTP, customerToken: String, paywallId: UUID?, versionId: UUID?, provider: IndianaSubscriptionProvider, currency: String, locale: String, content: (@Sendable (IndianaJSON) async throws -> IndianaJSON)? = nil) throws {
+        guard (paywallId == nil) != (versionId == nil), !locale.isEmpty, locale.count <= 35,
+              currency.range(of: "^[A-Z]{3}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidConfiguration }
+        self.configuration = configuration; self.http = http; self.token = customerToken
+        let reader = IndianaPaywallContent(configuration: configuration)
+        self.content = content ?? { try await reader.resolve($0) }
+        self.provider = provider; self.currency = currency; self.locale = locale
+        selector = paywallId.map { .object(["type":.string("paywall"),"paywallId":.string($0.uuidString.lowercased())]) }
+            ?? .object(["type":.string("version"),"versionId":.string(versionId!.uuidString.lowercased())])
+    }
+    public func close() { closed = true; token = nil; current = nil; quote = nil; operation = nil; pendingPreview = nil; invalidation?(); invalidation = nil }
+    internal func onInvalidation(_ callback: @escaping @Sendable () -> Void) { if closed { callback() } else { invalidation = callback } }
+    internal func hostConfiguration() -> IndianaConfiguration { configuration }
+    internal func hostInit() -> IndianaJSON {
+        .object(["event":.string("init"),"surface":.string("paywall"),"scope":.object(["projectId":.string(configuration.scope.projectId.uuidString.lowercased()),"environment":.string(configuration.scope.environment.rawValue)]),"apiOrigin":.string(configuration.apiOrigin)])
+    }
+    private func send(_ name: String, path: String, body: IndianaJSON) async throws -> IndianaJSON {
+        guard let token, !closed else { throw IndianaClientError.identityChanged }
+        let data = try JSONEncoder().encode(body)
+        try IndianaSchema.validate(name + "Request", data: data)
+        let result: Data
+        do { result = try await http.send(path: path, method: "POST", authorization: token, body: data) }
+        catch { guard !closed else { throw IndianaClientError.identityChanged }; throw error }
+        guard !closed else { throw IndianaClientError.identityChanged }
+        try IndianaSchema.validate(name + "Response", data: result)
+        struct Scoped: Decodable { let scope: IndianaScope }
+        guard try JSONDecoder().decode(Scoped.self, from: result).scope == configuration.scope else { throw IndianaClientError.invalidResponse }
+        var reply = try JSONDecoder().decode(IndianaJSON.self, from: result).object!
+        if name == "resolvePaywall" { reply["paywall"] = try await content(reply["paywall"]!); guard !closed else { throw IndianaClientError.identityChanged } }
+        return .object(reply)
+    }
+    private func canonical(_ value: IndianaJSON) throws -> Data { let encoder = JSONEncoder(); encoder.outputFormatting = .sortedKeys; return try encoder.encode(value) }
+    public func refresh() async throws -> IndianaJSON { try await hostCommand(.object(["operation":.string("resolve"),"input":.object([:])])) }
+    internal func hostCommand(_ payload: IndianaJSON) async throws -> IndianaJSON {
+        guard !closed, !busy, let envelope = payload.object, Set(envelope.keys) == Set(["operation","input"]), let action = envelope["operation"]?.string, let input = envelope["input"]?.object else { throw IndianaFunnelError.invalidCommand }
+        busy = true; defer { busy = false }
+        switch action {
+        case "resolve":
+            guard input.isEmpty else { throw IndianaFunnelError.invalidCommand }
+            let selected = current?.object?["id"].map { IndianaJSON.object(["type":.string("version"),"versionId":$0]) } ?? selector
+            let reply = try await send("resolvePaywall", path: "paywalls/resolve", body: .object(["selector":selected,"commerce":.object(["provider":.string(provider.rawValue),"currency":.string(currency)]),"locale":.string(locale)]))
+            guard let value = reply.object?["paywall"], let wall = value.object else { throw IndianaClientError.invalidResponse }
+            let key = selector.object?["type"]?.string == "version" ? "id" : "paywallId"
+            guard wall[key] == selector.object?[key == "id" ? "versionId" : "paywallId"],
+                  current == nil || (wall["id"] == current?.object?["id"] && wall["offering"]?.object?["id"] == current?.object?["offering"]?.object?["id"] && wall["content"]?.object?["artifact"]?.object?["sha256"] == current?.object?["content"]?.object?["artifact"]?.object?["sha256"]),
+                  wall["document"]?.object?["offeringVersionId"] == wall["offering"]?.object?["id"] else { throw IndianaClientError.invalidResponse }
+            current = value; return value
+        case "preview":
+            guard Set(input.keys).isSubset(of: ["actionId","productVersionId","requestId","offerId","nativeOffer","featureQuantities"]),
+                  let actionId = input["actionId"]?.string, let product = input["productVersionId"]?.string,
+                  let policy = current?.object?["document"]?.object?["buttons"]?.object?[actionId]?.object, policy["type"]?.string == "checkout",
+                  let selection = policy["product"]?.object else { throw IndianaFunnelError.invalidCommand }
+            let allowed: Bool
+            if selection["type"]?.string == "fixed" { allowed = selection["productVersionId"]?.string == product }
+            else if case .array(let ids) = selection["allowedProductVersionIds"] { allowed = ids.contains(.string(product)) }
+            else { allowed = false }
+            guard allowed else { throw IndianaFunnelError.invalidCommand }
+            let fingerprint = try canonical(payload)
+            if let pendingPreview, pendingPreview != fingerprint {
+                guard let status = operation?.object?["status"]?.string, status != "pending" else { throw IndianaFunnelError.commandPending }
+                quote = nil; operation = nil
+            }
+            if pendingPreview == fingerprint, let quote { return quote }
+            var selectedPlan: [String:IndianaJSON] = ["productVersionId":.string(product)]
+            selectedPlan["featureQuantities"] = input["featureQuantities"]
+            var fields: [String:IndianaJSON] = ["requestId":input["requestId"] ?? .null,"plans":.array([.object(selectedPlan)]),"provider":.string(provider.rawValue),"currency":.string(currency)]
+            fields["offerId"] = input["offerId"]; fields["nativeOffer"] = input["nativeOffer"]
+            let body = IndianaJSON.object(fields)
+            try IndianaSchema.validate("previewAttachRequest", data: JSONEncoder().encode(body))
+            pendingPreview = fingerprint
+            let reply = try await send("previewAttach", path:"subscriptions/preview-attach",body:body)
+            guard let value = reply.object?["quote"], let q = value.object, q["currency"]?.string == currency, q["provider"]?.string == provider.rawValue,
+                  case .array(let lines) = q["lines"], lines.count == 1, lines[0].object?["productVersionId"]?.string == product else { throw IndianaClientError.invalidResponse }
+            quote = value; operation = nil; return value
+        case "confirm", "cancel", "read":
+            guard input.isEmpty, let id = quote?.object?["operationId"] else { throw IndianaFunnelError.invalidCommand }
+            let body = action == "read" ? IndianaJSON.object(["operationId":id]) : .object(["operationId":id,"intent":.string(action)])
+            let reply = try await send(action == "read" ? "readSubscriptionOperation" : "attach", path: action == "read" ? "subscriptions/operations/read" : "subscriptions/attach", body:body)
+            guard let value = reply.object?["operation"], value.object?["operationId"] == id, value.object?["currency"]?.string == currency else { throw IndianaClientError.invalidResponse }
+            if operation?.object?["status"]?.string == "complete" { return operation! }
+            operation = value
+            if value.object?["status"]?.string != "pending" && value.object?["status"]?.string != "complete" { pendingPreview = nil; quote = nil }
+            return value
+        default: throw IndianaFunnelError.invalidCommand
+        }
+    }
+    internal func trustedPurchase(_ value: IndianaJSON) throws -> IndianaJSON {
+        guard !closed, value == operation, value.object?["status"]?.string == "pending" else { throw IndianaFunnelError.invalidCommand }; return value
+    }
+    internal func trustedCheckout(_ value: String) throws -> URL {
+        guard !closed, operation?.object?["status"]?.string == "pending", operation?.object?["checkoutUrl"]?.string == value, let url=URL(string:value), url.scheme == "https", url.user == nil, url.password == nil else { throw IndianaFunnelError.invalidCommand }; return url
+    }
+    internal func trustedAction(_ value: String, type: String) throws -> String {
+        guard !closed, let buttons=current?.object?["document"]?.object?["buttons"]?.object else { throw IndianaFunnelError.invalidCommand }
+        for policy in buttons.values {
+            let action=policy.object?["action"]?.object
+            if policy.object?["type"]?.string == "action", action?["type"]?.string == type, action?[type == "event" ? "event" : "url"]?.string == value { return value }
+        }
+        throw IndianaFunnelError.invalidCommand
+    }
+    internal func completedOperation() throws -> IndianaJSON {
+        guard !closed, let operation, operation.object?["status"]?.string == "complete" else { throw IndianaFunnelError.invalidCommand }; return operation
+    }
+}

package/native-sdk/ios/PaywallView.swift

@@ -0,0 +1,87 @@
+#if canImport(UIKit)
+import UIKit
+@preconcurrency import SafariServices
+import SwiftUI
+
+/// Independent Paywall UI using the same packaged renderer as Funnel.
+@MainActor public final class IndianaPaywallViewController: UIViewController, @preconcurrency SFSafariViewControllerDelegate {
+    public let session: IndianaPaywallSession
+    public var onPurchase: (@MainActor (IndianaJSON) async throws -> Void)?
+    public var onEvent: (@MainActor (String) async throws -> Void)?
+    public var onOpenURL: (@MainActor (URL) async throws -> Void)?
+    public var onComplete: (@MainActor (IndianaJSON) -> Void)?
+    public var onDismiss: (@MainActor () -> Void)?
+    public var onError: (@MainActor (Error) -> Void)?
+    private var host: IndianaBundledWebView!
+    private var stopped = false, dismissed = false
+    private var completions = Set<String>()
+    private var observer: IndianaForegroundObserver?
+    public init(session:IndianaPaywallSession) { self.session=session; super.init(nibName:nil,bundle:nil) }
+    required init?(coder:NSCoder) { fatalError("Use init(session:)") }
+    public override func loadView() {
+        host = IndianaBundledWebView(label:"Paywall",dispatch:{ [weak self] method,payload in
+            guard let self, !self.stopped else { throw IndianaClientError.identityChanged }
+            return try await self.dispatch(method,payload)
+        },onError:{ [weak self] error in self?.onError?(error) })
+        view=host.webView
+        Task {
+            await session.onInvalidation { [weak self] in Task { @MainActor in self?.invalidate() } }
+            guard !stopped else { return }; host.start()
+        }
+        observer=IndianaForegroundObserver { [weak self] in
+            Task { @MainActor in self?.host?.event("refresh") }
+        }
+    }
+    public func close() async { await session.close(); invalidate() }
+    private func invalidate() {
+        guard !stopped else { return }; stopped=true; host?.destroy()
+        observer=nil
+        presentedViewController?.dismiss(animated:false)
+        if !dismissed { dismissed=true; onDismiss?() }
+    }
+    private func dispatch(_ method:String,_ payload:IndianaJSON) async throws -> IndianaJSON {
+        switch method {
+        case "ready": host.send(await session.hostInit()); return .null
+        case "paywall": return try await session.hostCommand(payload)
+        case "purchase":
+            guard let value=payload.object?["operation"], let onPurchase else { throw IndianaClientError.unsupportedCapability }
+            try await onPurchase(try await session.trustedPurchase(value)); return .null
+        case "checkout":
+            guard let raw=payload.object?["url"]?.string else { throw IndianaFunnelError.invalidCommand }
+            open(try await session.trustedCheckout(raw)); return .null
+        case "open":
+            guard let raw=payload.object?["url"]?.string else { throw IndianaFunnelError.invalidCommand }
+            let trusted=try await session.trustedAction(raw,type:"open_url")
+            guard let url=URL(string:trusted),url.scheme == "https" else { throw IndianaFunnelError.invalidCommand }
+            if let onOpenURL { try await onOpenURL(url) } else { open(url) }; return .null
+        case "event":
+            guard let raw=payload.object?["event"]?.string,let onEvent else { throw IndianaClientError.unsupportedCapability }
+            try await onEvent(try await session.trustedAction(raw,type:"event")); return .null
+        case "complete":
+            let result=try await session.completedOperation()
+            if let id=result.object?["operationId"]?.string, completions.insert(id).inserted { onComplete?(result) }; return .null
+        case "dismiss": await close(); return .null
+        case "error": onError?(IndianaClientError.invalidResponse); return .null
+        default: throw IndianaFunnelError.invalidCommand
+        }
+    }
+    private func open(_ url:URL) { let browser=SFSafariViewController(url:url);browser.delegate=self;present(browser,animated:true) }
+    public func safariViewControllerDidFinish(_ controller:SFSafariViewController) { controller.dismiss(animated:true);host?.event("refresh") }
+}
+
+@MainActor public struct IndianaPaywallView: UIViewControllerRepresentable {
+    public let session:IndianaPaywallSession
+    public var onPurchase:(@MainActor (IndianaJSON) async throws -> Void)?
+    public var onEvent:(@MainActor (String) async throws -> Void)?
+    public var onOpenURL:(@MainActor (URL) async throws -> Void)?
+    public var onComplete:(@MainActor (IndianaJSON) -> Void)?
+    public var onDismiss:(@MainActor () -> Void)?
+    public var onError:(@MainActor (Error) -> Void)?
+    public init(session:IndianaPaywallSession,onPurchase:(@MainActor (IndianaJSON) async throws -> Void)?=nil,onEvent:(@MainActor (String) async throws -> Void)?=nil,onOpenURL:(@MainActor (URL) async throws -> Void)?=nil,onComplete:(@MainActor (IndianaJSON) -> Void)?=nil,onDismiss:(@MainActor () -> Void)?=nil,onError:(@MainActor (Error) -> Void)?=nil) {
+        self.session=session;self.onPurchase=onPurchase;self.onEvent=onEvent;self.onOpenURL=onOpenURL;self.onComplete=onComplete;self.onDismiss=onDismiss;self.onError=onError
+    }
+    public func makeUIViewController(context:Context)->IndianaPaywallViewController { let controller=IndianaPaywallViewController(session:session);updateUIViewController(controller,context:context);return controller }
+    public func updateUIViewController(_ controller:IndianaPaywallViewController,context:Context) { controller.onPurchase=onPurchase;controller.onEvent=onEvent;controller.onOpenURL=onOpenURL;controller.onComplete=onComplete;controller.onDismiss=onDismiss;controller.onError=onError }
+    public static func dismantleUIViewController(_ controller:IndianaPaywallViewController,coordinator:()) { Task { await controller.close() } }
+}
+#endif

package/native-sdk/ios/Protocol.swift

@@ -0,0 +1,49 @@
+import Foundation
+
+public struct IndianaScope: Codable, Sendable, Equatable {
+    public let projectId: UUID
+    public let environment: IndianaEnvironment
+    public init(projectId: UUID, environment: IndianaEnvironment) { self.projectId = projectId; self.environment = environment }
+    public init(from decoder: Decoder) throws {
+        try IndianaWire.keys(decoder, IndianaProtocol.scopeKeys)
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        projectId = try IndianaWire.uuid(c.decode(String.self, forKey: .projectId)); environment = try c.decode(IndianaEnvironment.self, forKey: .environment)
+    }
+}
+public enum IndianaClientError: Error, Sendable {
+    case invalidConfiguration, unauthenticated, identityChanged, unsupportedCapability, invalidResponse, requestFailed(Int), temporaryUnavailable, protectedStorageUnavailable
+}
+enum IndianaDates {
+    static func parse(_ value: String) -> Date? {
+        guard value.range(of: IndianaProtocol.utcPattern, options: .regularExpression) != nil else { return nil }
+        // The current contract permits ISO timestamps with fractional precision and UTC offsets. Preserve the wire
+        // string and reduce only the Date conversion to nanoseconds after validating its calendar.
+        var parseValue = value
+        if let match = value.range(of: "(?<=\\.)[0-9]+", options: .regularExpression) {
+            parseValue.replaceSubrange(match, with: value[match].prefix(9))
+        }
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        if let date = formatter.date(from: parseValue) { return date }
+        formatter.formatOptions = [.withInternetDateTime]
+        return formatter.date(from: parseValue)
+    }
+}
+enum IndianaWire {
+    static func uuid(_ value: String) throws -> UUID {
+        guard value.range(of: IndianaProtocol.uuidPattern, options: .regularExpression) != nil,
+              let id = UUID(uuidString: value) else { throw IndianaClientError.invalidResponse }
+        return id
+    }
+    private struct Key: CodingKey { let stringValue: String; let intValue: Int? = nil; init?(stringValue: String) { self.stringValue = stringValue }; init?(intValue: Int) { return nil } }
+    static func keys(_ decoder: Decoder, _ expected: Set<String>) throws {
+        let c = try decoder.container(keyedBy: Key.self)
+        guard Set(c.allKeys.map(\.stringValue)) == expected else { throw IndianaClientError.invalidResponse }
+    }
+    static func fields(_ decoder: Decoder, allowed: Set<String>, required: Set<String>) throws {
+        let c = try decoder.container(keyedBy: Key.self)
+        let actual = Set(c.allKeys.map(\.stringValue))
+        guard actual.isSubset(of: allowed), required.isSubset(of: actual) else { throw IndianaClientError.invalidResponse }
+    }
+}
+

package/native-sdk/ios/PushInstallation.swift

@@ -0,0 +1,154 @@
+import Foundation
+import CryptoKit
+import Security
+
+public enum IndianaPushPermission: String, Codable, Sendable { case unknown, denied, provisional, granted }
+public enum IndianaPushAddressKind: String, Sendable { case apnsToken = "apns_token", fcmToken = "fcm_token" }
+public struct IndianaPushObservation: Sendable {
+    public let connectionId: UUID?
+    public let kind: IndianaPushAddressKind?
+    public let token: String?
+    public let permission: IndianaPushPermission
+    public init(connectionId: UUID?, kind: IndianaPushAddressKind?, token: String?, permission: IndianaPushPermission) throws {
+        guard (connectionId == nil && kind == nil && token == nil) ||
+                (connectionId != nil && kind != nil && token != nil && (16...4096).contains(token!.utf8.count) && token!.utf8.allSatisfy({ (33...126).contains($0) })) else { throw IndianaClientError.invalidConfiguration }
+        self.connectionId = connectionId; self.kind = kind; self.token = token; self.permission = permission
+    }
+}
+public struct IndianaPushInstallationState: Decodable, Sendable {
+    public let installationId: UUID
+    public let bound: Bool
+    public let identitySeq: Int64
+    public let bindingGeneration: Int64
+    public let addressSeq: Int64
+    public let addressRevision: Int64
+    public let connectionId: UUID?
+    public let addressStatus: String?
+    public let permission: IndianaPushPermission
+    func validate(installation: UUID) throws {
+        guard installationId == installation, (1...IndianaPushIdentity.maxSequence).contains(identitySeq),
+              (1...IndianaPushIdentity.maxSequence).contains(bindingGeneration), (0...IndianaPushIdentity.maxSequence).contains(addressSeq),
+              (0...IndianaPushIdentity.maxSequence).contains(addressRevision), addressStatus == nil || ["active", "invalid"].contains(addressStatus!) else { throw IndianaClientError.invalidResponse }
+    }
+}
+/// Capture before starting asynchronous OS token work; an old callback cannot replace a newer observation.
+public struct IndianaPushObservationTicket: Sendable { let client: UUID; let identity: UUID; let observation: UUID }
+public struct IndianaPushRecoveryRequest: Decodable, Sendable {
+    public let requested: Bool
+    public let expiresAt: String
+}
+
+struct IndianaPushJournal: Codable, Sendable {
+    var installationId: UUID
+    var privateKey: Data
+    var identitySeq: Int64
+    var addressSeq: Int64
+    var detachSeq: Int64?
+    func validate() throws {
+        guard (0...IndianaPushIdentity.maxSequence).contains(identitySeq), (0...IndianaPushIdentity.maxSequence).contains(addressSeq),
+              detachSeq == nil || (detachSeq! > 0 && detachSeq! <= identitySeq),
+              (try? P256.Signing.PrivateKey(rawRepresentation: privateKey)) != nil else { throw IndianaClientError.protectedStorageUnavailable }
+    }
+}
+protocol IndianaPushJournalStorage: Sendable {
+    /// A synchronous durable write: lifecycle changes cannot cross an await before the intent is saved.
+    func transaction(_ update: (IndianaPushJournal) throws -> IndianaPushJournal) throws -> IndianaPushJournal
+}
+final class IndianaPushKeychain: IndianaPushJournalStorage, @unchecked Sendable {
+    private let service: String
+    private static let lock = NSLock()
+    init(scope: IndianaScope) { service = "\(Bundle.main.bundleIdentifier ?? "Indiana").indiana.push.v1.\(scope.projectId.uuidString.lowercased()).\(scope.environment.rawValue)" }
+    func transaction(_ update: (IndianaPushJournal) throws -> IndianaPushJournal) throws -> IndianaPushJournal {
+        Self.lock.lock(); defer { Self.lock.unlock() }
+        let query: [String: Any] = [kSecClass as String:kSecClassGenericPassword, kSecAttrService as String:service, kSecAttrAccount as String:"installation"]
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query.merging([kSecReturnData as String:true]) { _, new in new } as CFDictionary, &result)
+        let current: IndianaPushJournal
+        if status == errSecItemNotFound {
+            current = IndianaPushJournal(installationId: UUID(), privateKey: P256.Signing.PrivateKey().rawRepresentation, identitySeq: 0, addressSeq: 0, detachSeq: nil)
+        } else {
+            guard status == errSecSuccess, let data = result as? Data, data.count <= 4096,
+                  let decoded = try? JSONDecoder().decode(IndianaPushJournal.self, from: data) else { throw IndianaClientError.protectedStorageUnavailable }
+            current = decoded
+        }
+        try current.validate()
+        let next = try update(current); try next.validate()
+        guard next.installationId == current.installationId, next.privateKey == current.privateKey,
+              next.identitySeq >= current.identitySeq, next.addressSeq >= current.addressSeq else { throw IndianaClientError.protectedStorageUnavailable }
+        if status == errSecItemNotFound || next.identitySeq != current.identitySeq || next.addressSeq != current.addressSeq || next.detachSeq != current.detachSeq {
+            let data = try JSONEncoder().encode(next)
+            let saved = status == errSecItemNotFound
+                ? SecItemAdd(query.merging([kSecValueData as String:data, kSecAttrAccessible as String:kSecAttrAccessibleWhenUnlockedThisDeviceOnly]) { _, new in new } as CFDictionary, nil)
+                : SecItemUpdate(query as CFDictionary, [kSecValueData as String:data] as CFDictionary)
+            guard saved == errSecSuccess else { throw IndianaClientError.protectedStorageUnavailable }
+        }
+        return next
+    }
+}
+
+/// Owned by the existing IndianaClient actor. No credential, transport or provider token is persisted here.
+final class IndianaPushIdentity {
+    static let maxSequence: Int64 = 9_007_199_254_740_991
+    let storage: any IndianaPushJournalStorage
+    init(storage: any IndianaPushJournalStorage) throws { self.storage = storage; _ = try state() }
+    func state() throws -> IndianaPushJournal { try storage.transaction { $0 } }
+    func reserve(detach: Bool = false) throws -> Int64 {
+        try storage.transaction { current in
+            guard current.identitySeq < Self.maxSequence else { throw IndianaClientError.protectedStorageUnavailable }
+            var next = current; next.identitySeq += 1
+            if detach { next.detachSeq = next.identitySeq }
+            return next
+        }.identitySeq
+    }
+    func reserveAddress() throws -> Int64 {
+        try storage.transaction { current in
+            guard current.addressSeq < Self.maxSequence else { throw IndianaClientError.protectedStorageUnavailable }
+            var next = current; next.addressSeq += 1; return next
+        }.addressSeq
+    }
+    func clearDetach(_ sequence: Int64) throws {
+        _ = try storage.transaction { current in var next = current; if next.detachSeq == sequence { next.detachSeq = nil }; return next }
+    }
+    func recover(remote: IndianaPushInstallationState, expected: Int64) throws -> Int64 {
+        try storage.transaction { current in
+            guard current.identitySeq == expected else { throw IndianaClientError.identityChanged }
+            let floor = max(current.identitySeq, remote.identitySeq)
+            guard floor < Self.maxSequence else { throw IndianaClientError.protectedStorageUnavailable }
+            var next = current; next.identitySeq = floor + 1; next.addressSeq = max(current.addressSeq, remote.addressSeq); return next
+        }.identitySeq
+    }
+    static func digest(_ credential: String) -> String { SHA256.hash(data: Data(credential.utf8)).map { String(format: "%02x", $0) }.joined() }
+    static func base64url(_ bytes: Data) -> String { bytes.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "") }
+    func command(_ operation: String, scope: IndianaScope, sequence: Int64? = nil, credential: String? = nil, observation: IndianaPushObservation? = nil, challenge: String? = nil) throws -> Data {
+        let journal = try state(), key = try P256.Signing.PrivateKey(rawRepresentation: journal.privateKey)
+        let publicKey = Self.base64url(key.publicKey.derRepresentation), installation = journal.installationId.uuidString.lowercased()
+        let formatter = ISO8601DateFormatter(); formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        let issuedAt = formatter.string(from: Date())
+        var fields: [Any] = ["indiana_push_v1", operation, scope.projectId.uuidString.lowercased(), scope.environment.rawValue, installation, publicKey, issuedAt]
+        var input: [String: Any] = ["installationId":installation, "publicKey":publicKey, "issuedAt":issuedAt]
+        let null = NSNull()
+        switch operation {
+        case "bind", "detach":
+            guard let sequence else { throw IndianaClientError.invalidConfiguration }
+            fields += [sequence, "ios"]; input["sequence"] = sequence; input["platform"] = "ios"
+            if operation == "bind" { guard let credential else { throw IndianaClientError.unauthenticated }; let digest = Self.digest(credential); fields.append(digest); input["credentialDigest"] = digest }
+        case "read":
+            guard let credential else { throw IndianaClientError.unauthenticated }; let digest = Self.digest(credential); fields.append(digest); input["credentialDigest"] = digest
+        case "address", "recovery_request", "recovery_confirm":
+            guard let sequence, let credential, let observation else { throw IndianaClientError.invalidConfiguration }
+            let digest = Self.digest(credential)
+            fields += [sequence, digest, observation.connectionId?.uuidString.lowercased() as Any? ?? null, observation.kind?.rawValue as Any? ?? null, observation.token as Any? ?? null, observation.permission.rawValue]
+            input["sequence"] = sequence; input["credentialDigest"] = digest; input["connectionId"] = observation.connectionId?.uuidString.lowercased() ?? null as Any
+            input["kind"] = observation.kind?.rawValue ?? null as Any; input["token"] = observation.token ?? null as Any; input["permission"] = observation.permission.rawValue
+            if operation == "recovery_confirm" {
+                guard let challenge, (100...3500).contains(challenge.utf8.count), challenge.utf8.allSatisfy({ (48...57).contains($0) || (65...90).contains($0) || (97...122).contains($0) || $0 == 45 || $0 == 95 }) else { throw IndianaClientError.invalidConfiguration }
+                fields.append(challenge); input["challenge"] = challenge
+            }
+        default: throw IndianaClientError.invalidConfiguration
+        }
+        let bytes = try JSONSerialization.data(withJSONObject: fields, options: [.withoutEscapingSlashes])
+        input["signature"] = Self.base64url(try key.signature(for: bytes).rawRepresentation)
+        if operation == "detach" { input["projectId"] = scope.projectId.uuidString.lowercased(); input["environment"] = scope.environment.rawValue }
+        return try JSONSerialization.data(withJSONObject: input, options: [.withoutEscapingSlashes])
+    }
+}

package/native-sdk/ios/RendererNavigation.swift

@@ -0,0 +1,8 @@
+import Foundation
+
+/// Subframes can execute only the renderer bytes shipped with this SDK.
+func indianaAllowsFunnelRendererNavigation(_ offered: URL, baseURL: URL) -> Bool {
+    guard baseURL.absoluteString == "https://indiana-sdk.invalid/",
+          let expected = try? IndianaBundledWebViewResources.rendererURL() else { return false }
+    return offered.absoluteString.components(separatedBy: "#").first == expected
+}