@tinkerlandai/indiana-sdk 0.8.3 → 0.8.5

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Release facts and artifact evidence: [SDK release ledger](../../docs/sdk-releases.md).
 
+## 0.8.5 — 2026-10-27
+
+- Add direct browser script loading through `/sdk.js`, sharing the npm browser APIs and page/visual experiment factories without requiring a bundler. Website deployment distributes this entry independently of npm publication.
+- Keep IAM release markers attached through host updates, group render-signature queries, and recover bounded visual work without duplicate exposure events.
+- Disable Funnel Back navigation until the current presentation is rendered, and include the SDK version in experiment-event requests.
+- Synchronize the packaged Web, iOS and Android renderers while retaining HTTP protocol 0.8.
+
+## 0.8.4 — 2026-10-26
+
+- Add `prepareContent` and `preparePopup` to render authorized content before the opening click and reveal the same iframe on demand.
+- Prepare bounded HTML DOM templates for supplied pages and Product variants; update variable text in place while preserving styles, images and unrelated content. Reuse inactive variants with empty variable slots.
+- Prepare Local Funnel rule definitions once per pure segment and send advance signals without waiting for advisory prediction downloads. Late predictions remain fenced by Run position and identity.
+- Synchronize the packaged Web, iOS and Android renderers. Retain HTTP protocol 0.8 and server authority over Funnel acceptance and commercial operations.
+- Carry the committed Merchandise context through Feature evaluation, page experiments, Analytics events and Coupon applicability; refresh the generated native Paywall schema.
+- Include the committed Android Push recovery proofs, visual target diagnostics and Paywall/Funnel focus restoration fixes.
+
 ## 0.8.3 — 2026-10-26
 
 - Refresh sanitized custom HTML fallback content when Product availability changes.

package/README.md

@@ -1,6 +1,6 @@
 # @tinkerlandai/indiana-sdk
 
-These examples use SDK 0.8.1 with `https://api.dev.tinker.cash` and test App credentials (protocol 0.8). Check [environment state](../../docs/development-status.md) before switching. The SDK default remains the production API, so set `baseUrl` explicitly for these examples.
+These examples use SDK 0.8.4 with `https://api.dev.tinker.cash` and test App credentials (protocol 0.8). Check [environment state](../../docs/development-status.md) before switching. The SDK default remains the production API, so set `baseUrl` explicitly for these examples.
 
 [简体中文](./README.zh-CN.md)
 
@@ -9,13 +9,42 @@ The Indiana business SDK groups its capabilities as **Identity, Commerce, Growth
 **IAM source scanning, generation, validation and upload belong to the independent build package `@tinkerlandai/indiana-iam`.** This business SDK retains only the runtime release binding used by GB visual changes. See [SDK boundaries](../../docs/sdk-architecture.md) and the [IAM package](../iam/README.md).
 
 ```sh
-npm install --save-exact @tinkerlandai/indiana-sdk@0.8.1
+npm install --save-exact @tinkerlandai/indiana-sdk@0.8.4
 ```
 
-SDK 0.8.1 requires HTTP protocol 0.8. Install a version that matches your runtime; publishing a package does not deploy the server. Publication and accepted environment scope are recorded in the [release ledger](../../docs/sdk-releases.md) and [development status](../../docs/development-status.md).
+SDK 0.8.4 requires HTTP protocol 0.8. Install a version that matches your runtime; publishing a package does not deploy the server. Publication and accepted environment scope are recorded in the [release ledger](../../docs/sdk-releases.md) and [development status](../../docs/development-status.md).
 
 The data/session layer handles public JSON, integrity checks and authenticated operations. The presentation host composes that layer with the packaged screen renderer; the renderer receives supplied data and emits action intents. Client display entry points load presentation lazily. The `/server` entry has no screen presentation dependency and uses a scoped Server Key only on your backend. A local SDK guard never replaces runtime authorization or verified payment completion. Console preview supplies simulated data/session results to the same presentation host.
 
+## Plain HTML / script installation
+
+The classic-script entry reuses the npm browser implementation, with no bundler:
+
+```html
+<script src="https://dev.tinker.cash/sdk.js"></script>
+<script type="module">
+  const {
+    createIndiana,
+    createPaywallSession,
+    showPaywall,
+    createFunnelRunController,
+    showFunnelRun,
+    mountContent,
+  } = await Indiana.ready;
+  const client = createIndiana({
+    baseUrl: "https://api.dev.tinker.cash",
+    scope: { projectId: "<APP_UUID>", environment: "sandbox" },
+  });
+  // Obtain customerToken from your authenticated backend session endpoint.
+  // client.identify(customerToken);
+  // await client.readHoldings();
+  // client.track("page_viewed", { page: location.pathname });
+  // await client.flush();
+</script>
+```
+
+Production uses `https://tinker.cash/sdk.js` and its matching API/credentials. `Indiana.ready` provides every root browser export plus `createPageExperiments` and `createVisualExperiments`; replace npm imports below with destructuring those names. Loading activates no sessions, events or experiments. Server Keys remain on your backend; Funnel start/recovery and logout cleanup retain the existing contracts. Duplicate tags share readiness, failures reject the Promise and UI loads lazily. With `async`/`defer`, wait for the loader tag's load event before accessing `Indiana`. CSP must allow the script origin and API connections. Page experiments use the same script entry; explicitly create their clients and call `start()`. See [script distribution](../../docs/sdk-architecture.md#web-script-distribution) and [the complete integration example](https://tinker.cash/docs/javascript#script).
+
 ## React Native core
 
 Use the independent `@tinkerlandai/indiana-react-native` package. The `@tinkerlandai/indiana-sdk/react-native` subpath shares the same implementation. Both support Customer Token identity, holdings, entitlement checks and usage reporting through your authenticated backend. It requires no DOM or native UI/store bridge. See [mobile SDK installation and examples](../../docs/mobile-sdk.md).
@@ -217,6 +246,26 @@ The selected environment's integration settings control behavior events, experim
 
 Flags default to local evaluation; Owner/Admin can switch each flag to server evaluation. Server-evaluated flags deliver only keys and results, using the caller's fallback until the first result arrives. Attribute changes immediately discard old results. List hashes are not a secrecy boundary. Local Funnels cannot depend on server-evaluated flags; mode switches also check active historical Runs. `identify` / `reset` release the previous identity's Feature instances and event queue.
 
+Merchandise targeting resolves a trusted item in the selected App/environment. Register its attributes and maintain the
+item in Console, then pass a reference rather than item metadata. The SDK resolves the initial SKU before returning;
+after switching items, await context refresh before reading the next decision. Item experiments use `merchandiseId`
+(the internal UUID) without a Customer fallback; Customer experiments keep their own bucketing identity.
+
+```ts
+const merchandiseFlags = await indiana.features({
+  attributes: { ...bucketingIdentity, merchandise: { id: "sku-outdoor" } },
+});
+merchandiseFlags.setAttributes({
+  ...bucketingIdentity,
+  merchandise: { id: "sku-indoor" },
+});
+await merchandiseFlags.refreshRemote();
+const eligible = merchandiseFlags.isOn("item-promotion");
+indiana.track("Item Viewed", {}, { merchandise: { id: "sku-indoor" } });
+await indiana.flush();
+merchandiseFlags.destroy();
+```
+
 Offering pins the Product Version scope and hierarchy. Paywall pins a published Offering Version and independently chooses its displayed Product subset, groups, ordering, and default selection. `createPaywallStartClient`, `createPaywallSession`, and `showPaywall` use a standalone Paywall Session. After payment, read Entitlements again. Your backend still authorizes requests and consumes usage idempotently.
 
 ## Commercial capabilities and current service boundaries
@@ -378,3 +427,24 @@ export async function showBanner(
 ```
 
 Provide every declared action handler. `onContinue` uses `intent.requestId` as its backend idempotency key; `retryAction()` reuses that intent after a failure. Call `destroy()` on unmount, sign-out or account change. The host renders content and emits intents; your backend still authorizes and executes business actions.
+
+To remove module loading, document preparation and iframe startup from the opening click, resolve the current Customer's content earlier and prepare it explicitly:
+
+```ts
+import { prepareContent } from "@tinkerlandai/indiana-sdk";
+
+const lifetime = new AbortController();
+const popup = await prepareContent(container, {
+  content, // Already resolved with kind: "popup" for this Customer.
+  actions: { continue: onContinue },
+  onError: console.error,
+  signal: lifetime.signal,
+});
+openButton.addEventListener("click", () => popup.show(), {
+  signal: lifetime.signal,
+});
+// On unmount, sign-out or account/scope change:
+// lifetime.abort();
+```
+
+Preparation waits for the first render without opening the dialog or running actions. `show()` reveals the same iframe and is idempotent; destroy and prepare a fresh handle for another presentation. Abort also cancels preparation while it is pending. This does not pre-authorize business operations or guarantee that images have decoded. For low-level ScreenDocument rendering, `/popup` provides `preparePopup(document, options)` with `ready`, `show()` and `destroy()`.

package/README.zh-CN.md

@@ -1,6 +1,6 @@
 [English](./README.md)
 
-本页使用 SDK 0.8.1、`https://api.dev.tinker.cash` 与测试 App 凭据（协议 0.8）。切换前核对[环境状态](../../docs/development-status.md)。SDK 默认仍指向生产 API，本页示例必须显式设置 `baseUrl`。
+本页使用 SDK 0.8.4、`https://api.dev.tinker.cash` 与测试 App 凭据（协议 0.8）。切换前核对[环境状态](../../docs/development-status.md)。SDK 默认仍指向生产 API，本页示例必须显式设置 `baseUrl`。
 
 # @tinkerlandai/indiana-sdk
 
@@ -9,13 +9,42 @@
 **IAM 的源码扫描、生成、校验和上传属于独立构建包 `@tinkerlandai/indiana-iam`。** 普通业务 SDK 只保留 GB visual 应用页面变更所需的运行时 release 绑定。完整定义见 [SDK 边界](../../docs/sdk-architecture.md) 与 [IAM 构建包](../iam/README.md)。
 
 ```sh
-npm install --save-exact @tinkerlandai/indiana-sdk@0.8.1
+npm install --save-exact @tinkerlandai/indiana-sdk@0.8.4
 ```
 
-SDK 0.8.1 要求 HTTP 协议 0.8。安装版本须与运行服务匹配；发布包不会部署服务端。实际发布、标签与环境验收范围见 [SDK 发布总账](../../docs/sdk-releases.md) 和 [开发状态](../../docs/development-status.md)。
+SDK 0.8.4 要求 HTTP 协议 0.8。安装版本须与运行服务匹配；发布包不会部署服务端。实际发布、标签与环境验收范围见 [SDK 发布总账](../../docs/sdk-releases.md) 和 [开发状态](../../docs/development-status.md)。
 
 数据／会话层负责公开 JSON、完整性校验和鉴权操作；展示宿主将会话接口接入打包的屏幕渲染器，渲染器消费已提供的数据并返回动作意图。客户端按需加载展示；`/server` 入口使用商户后端的受限 Server Key，不加载屏幕展示。SDK 本地检查不替代运行时授权或付款核实。后台 Preview 为同一个展示宿主提供模拟会话和数据。
 
+## 普通 HTML / script 接入
+
+普通 script 标签复用 npm 浏览器实现，无需打包工具：
+
+```html
+<script src="https://dev.tinker.cash/sdk.js"></script>
+<script type="module">
+  const {
+    createIndiana,
+    createPaywallSession,
+    showPaywall,
+    createFunnelRunController,
+    showFunnelRun,
+    mountContent,
+  } = await Indiana.ready;
+  const client = createIndiana({
+    baseUrl: "https://api.dev.tinker.cash",
+    scope: { projectId: "<APP_UUID>", environment: "sandbox" },
+  });
+  // 从验证登录后的自有后端接口获取 customerToken。
+  // client.identify(customerToken);
+  // await client.readHoldings();
+  // client.track("page_viewed", { page: location.pathname });
+  // await client.flush();
+</script>
+```
+
+生产脚本为 `https://tinker.cash/sdk.js`，配套使用同环境 API 和凭据。`Indiana.ready` 返回根入口的全部浏览器导出，以及 `createPageExperiments` / `createVisualExperiments`；下文 npm import 可替换为从该 Promise 解构同名函数。加载不自动创建会话、发送事件或启动实验。Server Key 留在后端，Funnel 启动恢复与退出清理沿用现有流程。重复标签共用 ready，失败会拒绝 Promise，UI 按需加载。加载标签使用普通 script；添加 async/defer 时先等标签 load 事件，再访问 Indiana。CSP 需允许脚本来源和 API 连接。页面实验也使用该统一入口，显式创建客户端并调用 `start()`。详见 [script 分发](../../docs/sdk-architecture.md#web-script-distribution)和[完整接入示例](https://tinker.cash/docs/javascript#script)。
+
 ## React Native 核心入口
 
 React Native 使用独立包 `@tinkerlandai/indiana-react-native`，原 `@tinkerlandai/indiana-sdk/react-native` 子入口共用同一实现。两者均支持 Customer Token 身份接入、权益读取和经业务后端转发的用量上报。此入口无需 DOM，不包含原生 UI 或内购桥接。参见[移动端 SDK 安装与示例](../../docs/mobile-sdk.md)。
@@ -206,6 +235,10 @@ flags.destroy();
 
 每个 flag 默认本地计算，Owner/Admin 可切换为服务器计算。服务器 flag 只下发键与结果，首次结果到达前使用调用方默认值；属性变化立即丢弃旧结果。名单哈希不等于保密，敏感规则应使用服务器计算。本地 Funnel 不得依赖服务器 flag，切换时也会校验仍在运行的历史版本。`identify` / `reset` 会释放旧身份的功能实例和事件队列。
 
+商品定向使用当前 App／环境的可信商品主档。在 Console 登记属性并维护商品后，传入 `merchandise: { id: "sku-outdoor" }` 引用；SDK 在返回 Feature 客户端之前解析商品。切换商品后，先调用 `setAttributes({ ...bucketingIdentity, merchandise: { id: "sku-indoor" } })`，再等待 `refreshRemote()` 后读取决策。商品实验使用服务端解析的 `merchandiseId`（内部 UUID），不能回退到人的分桶标识。请求中的商品属性不能覆盖主档。
+
+自定义商品事件可调用 `indiana.track("Item Viewed", {}, { merchandise: { id: "sku-indoor" } })`，再 `flush()`。Customer 身份、商品引用和实验分桶单位分别记录；事件不构成订单或收入回执。
+
 Offering 固定 Product Version 的范围与层级。Paywall 固定已发布 Offering Version，并独立选择显示的 Product 子集、分组、顺序和默认项。`createPaywallStartClient`、`createPaywallSession`、`showPaywall` 使用独立 Paywall Session，不创建占位 Funnel。付款完成后重新查询权益，业务后端仍须重新鉴权并幂等扣减用量。
 
 ## Web 商业能力与当前服务边界
@@ -299,3 +332,7 @@ export async function showBanner(
 ```
 
 每个声明动作都需要同名 handler。`onContinue` 用 `intent.requestId` 作为业务后端的幂等键；失败后 `retryAction()` 重用原意图。卸载、退出或换号时调用 `destroy()`。宿主只渲染和发出意图，业务后端仍负责鉴权与执行。
+
+需要加快点击打开时，可提前为当前 Customer 读取内容，再调用根入口的 `prepareContent(container, options)`，参数与 `mountContent` 相同。它提前加载展示模块、校验文档并启动 iframe，等首次渲染后返回句柄；点击时同步调用 `handle.show()`，直接显示同一个 iframe。准备期间不打开弹窗、不抢焦点、不执行动作。句柄用于一次展示，重复 `show()` 不重复挂载；下一次展示需重新准备。
+
+可传入 `signal: abortController.signal`，在卸载、退出或切换 Customer／App／环境时 `abortController.abort()`，连同仍在等待的准备一起取消并释放资源。预渲染不代替业务鉴权，也不保证图片已完成解码。直接持有已授权 ScreenDocument 的低层接入可使用 `/popup` 的 `preparePopup(document, options)`；句柄立即返回，提供 `ready`、`show()` 和 `destroy()`。

package/dist/{ai-usage-BV-FlgWr.d.ts → ai-usage-DUlre7JC.d.ts}

@@ -1,5 +1,5 @@
 import { LanguageModelV4Usage, LanguageModelV4Middleware } from '@ai-sdk/provider';
-import { F as FoundationApi, A as ApiInput } from './api-B3FIE41b.js';
+import { F as FoundationApi, A as ApiInput } from './api-XDc4pRlN.js';
 import { z } from 'zod';
 
 declare const tokenCounts: z.ZodObject<{

package/dist/{api-B3FIE41b.d.ts → api-XDc4pRlN.d.ts}

@@ -1650,6 +1650,10 @@ declare const apiOperations: {
                     stickyBucketUsed: z$1.ZodOptional<z$1.ZodBoolean>;
                 }, z$1.core.$strict>>;
             }, z$1.core.$strict>>;
+            merchandiseContext: z$1.ZodOptional<z$1.ZodObject<{
+                merchandiseId: z$1.ZodUUID;
+                merchandise: z$1.ZodRecord<z$1.ZodString, z$1.ZodJSONSchema>;
+            }, z$1.core.$strict>>;
         }, z$1.core.$strict>;
     };
     readonly trackEvents: {
@@ -1663,6 +1667,11 @@ declare const apiOperations: {
                 eventUuid: z$1.ZodUUID;
                 timestamp: z$1.ZodISODateTime;
                 name: z$1.ZodString;
+                merchandise: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodObject<{
+                    id: z$1.ZodString;
+                }, z$1.core.$strict>, z$1.ZodObject<{
+                    internalId: z$1.ZodUUID;
+                }, z$1.core.$strict>]>>;
                 properties: z$1.ZodDefault<z$1.ZodRecord<z$1.ZodString, z$1.ZodJSONSchema>>;
                 deviceId: z$1.ZodOptional<z$1.ZodString>;
                 sessionId: z$1.ZodOptional<z$1.ZodString>;
@@ -10851,13 +10860,22 @@ declare const apiOperations: {
                     }, z$1.core.$strict>, z$1.ZodObject<{
                         type: z$1.ZodLiteral<"plans">;
                         planIds: z$1.ZodArray<z$1.ZodUUID>;
+                    }, z$1.core.$strict>, z$1.ZodObject<{
+                        type: z$1.ZodLiteral<"merchandise">;
+                        scope: z$1.ZodObject<{
+                            type: z$1.ZodEnum<{
+                                selected: "selected";
+                                all: "all";
+                                condition: "condition";
+                            }>;
+                        }, z$1.core.$strict>;
                     }, z$1.core.$strict>], "type">;
                 }, z$1.core.$strict>;
             }, z$1.core.$strict>>;
             reason: z$1.ZodNullable<z$1.ZodEnum<{
                 unavailable: "unavailable";
-                claim_disabled: "claim_disabled";
                 inactive: "inactive";
+                claim_disabled: "claim_disabled";
                 outside_window: "outside_window";
                 not_targeted: "not_targeted";
                 not_first_purchase: "not_first_purchase";
@@ -10951,6 +10969,15 @@ declare const apiOperations: {
                     }, z$1.core.$strict>, z$1.ZodObject<{
                         type: z$1.ZodLiteral<"plans">;
                         planIds: z$1.ZodArray<z$1.ZodUUID>;
+                    }, z$1.core.$strict>, z$1.ZodObject<{
+                        type: z$1.ZodLiteral<"merchandise">;
+                        scope: z$1.ZodObject<{
+                            type: z$1.ZodEnum<{
+                                selected: "selected";
+                                all: "all";
+                                condition: "condition";
+                            }>;
+                        }, z$1.core.$strict>;
                     }, z$1.core.$strict>], "type">;
                 }, z$1.core.$strict>;
             }, z$1.core.$strict>>;
@@ -11049,13 +11076,22 @@ declare const apiOperations: {
                     }, z$1.core.$strict>, z$1.ZodObject<{
                         type: z$1.ZodLiteral<"plans">;
                         planIds: z$1.ZodArray<z$1.ZodUUID>;
+                    }, z$1.core.$strict>, z$1.ZodObject<{
+                        type: z$1.ZodLiteral<"merchandise">;
+                        scope: z$1.ZodObject<{
+                            type: z$1.ZodEnum<{
+                                selected: "selected";
+                                all: "all";
+                                condition: "condition";
+                            }>;
+                        }, z$1.core.$strict>;
                     }, z$1.core.$strict>], "type">;
                 }, z$1.core.$strict>;
             }, z$1.core.$strict>>;
             reason: z$1.ZodNullable<z$1.ZodEnum<{
                 unavailable: "unavailable";
-                claim_disabled: "claim_disabled";
                 inactive: "inactive";
+                claim_disabled: "claim_disabled";
                 outside_window: "outside_window";
                 not_targeted: "not_targeted";
                 not_first_purchase: "not_first_purchase";
@@ -11070,14 +11106,20 @@ declare const apiOperations: {
         readonly permission: "billing:write";
         readonly audience: "server";
         /** A stable merchant event records paid Coupon use; this does not verify a provider or grant subscription access. */
-        readonly request: z$1.ZodObject<{
+        readonly request: z$1.ZodUnion<readonly [z$1.ZodObject<{
+            productVersionId: z$1.ZodUUID;
+            subscriptionId: z$1.ZodString;
             customerId: z$1.ZodUUID;
             eventId: z$1.ZodString;
             grantId: z$1.ZodUUID;
-            productVersionId: z$1.ZodUUID;
-            subscriptionId: z$1.ZodString;
             occurredAt: z$1.ZodISODateTime;
-        }, z$1.core.$strict>;
+        }, z$1.core.$strict>, z$1.ZodObject<{
+            merchandiseId: z$1.ZodUUID;
+            customerId: z$1.ZodUUID;
+            eventId: z$1.ZodString;
+            grantId: z$1.ZodUUID;
+            occurredAt: z$1.ZodISODateTime;
+        }, z$1.core.$strict>]>;
         readonly response: z$1.ZodObject<{
             requestId: z$1.ZodUUID;
             scope: z$1.ZodObject<{
@@ -11087,19 +11129,30 @@ declare const apiOperations: {
                     live: "live";
                 }>;
             }, z$1.core.$strict>;
-            receipt: z$1.ZodObject<{
+            receipt: z$1.ZodUnion<readonly [z$1.ZodObject<{
+                productVersionId: z$1.ZodUUID;
+                subscriptionId: z$1.ZodString;
                 customerId: z$1.ZodUUID;
                 eventId: z$1.ZodString;
                 grantId: z$1.ZodUUID;
-                productVersionId: z$1.ZodUUID;
-                subscriptionId: z$1.ZodString;
                 occurredAt: z$1.ZodISODateTime;
                 id: z$1.ZodUUID;
                 couponId: z$1.ZodUUID;
                 status: z$1.ZodLiteral<"redeemed">;
                 source: z$1.ZodLiteral<"merchant">;
                 recordedAt: z$1.ZodISODateTime;
-            }, z$1.core.$strict>;
+            }, z$1.core.$strict>, z$1.ZodObject<{
+                merchandiseId: z$1.ZodUUID;
+                customerId: z$1.ZodUUID;
+                eventId: z$1.ZodString;
+                grantId: z$1.ZodUUID;
+                occurredAt: z$1.ZodISODateTime;
+                id: z$1.ZodUUID;
+                couponId: z$1.ZodUUID;
+                status: z$1.ZodLiteral<"redeemed">;
+                source: z$1.ZodLiteral<"merchant">;
+                recordedAt: z$1.ZodISODateTime;
+            }, z$1.core.$strict>]>;
         }, z$1.core.$strict>;
     };
 };

package/dist/chunk-3KQHKRZJ.js

@@ -0,0 +1 @@
+import{o as E,p as L,s as R}from"./chunk-6A5WWFNS.js";import{a as e}from"./chunk-SOQO2RDZ.js";import{a as P,j as C,m as D,p as j}from"./chunk-LMR2TM3X.js";import{b}from"./chunk-OBYJWIRB.js";import{a as U,b as M}from"./chunk-WWUUVURR.js";var H=Symbol("IndianaNoContent");function Q(u,q,k=URL){let l=u.configuration?.scope,A=u.scope??(l&&{projectId:l.projectId,environment:l.environment}),s=A?b.parse(A):void 0;if(s&&l&&(s.projectId!==l.projectId||s.environment!==l.environment))throw new e("SCOPE_MISMATCH","Configuration belongs to another App/environment");let i=new k(u.baseUrl??M);if(i.username||i.password||i.search||i.hash)throw new e("INVALID_URL","baseUrl must not contain credentials, query, or fragment");if(i.protocol!=="https:"&&!(i.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(i.hostname)))throw new e("INVALID_URL","Use HTTPS, or HTTP on localhost during development");let V=u.fetch??globalThis.fetch.bind(globalThis),p=u.timeoutMs??1e4;if(!Number.isFinite(p)||p<1||p>12e4)throw new e("INVALID_TIMEOUT","timeoutMs must be between 1 and 120000");let m=null,f=0,h=null,w=new Set;function O(){f+=1,m=null,h=null;for(let a of w)a.abort();w.clear()}async function K(a,x={},T="POST",v={}){let d=v.installationDetach===!0;if(d&&(a!=="push/installations/detach"||T!=="POST"))throw new e("INVALID_REQUEST","Installation authority only detaches this installation");if(!m&&!d)throw new e("NOT_IDENTIFIED","Call identify with a server-issued customer token first");let y=f,o=new AbortController;d||w.add(o);let g=()=>!d&&y!==f?new e("IDENTITY_CHANGED","Customer identity changed while the request was in flight"):new e("TIMEOUT","Indiana request timed out"),S,F=new Promise((n,r)=>{S=()=>r(g()),o.signal.addEventListener("abort",S,{once:!0})}),X=setTimeout(()=>o.abort(),p),$=async()=>{let n=await V(`${i.href.replace(/\/$/,"")}/api/v1/${a}`,{method:T,headers:{"Content-Type":"application/json",...d?{}:{Authorization:`Bearer ${m}`},[E]:R.current,[L]:U.version,...s?{"X-Indiana-Project":s.projectId,"X-Indiana-Environment":s.environment}:{}},body:T==="POST"?JSON.stringify(x):void 0,signal:o.signal,credentials:"omit",cache:"no-store",redirect:"error",...v.keepalive?{keepalive:!0}:{}});if(o.signal.aborted)throw g();let r;try{r=n.status===204?H:await n.json()}catch{throw o.signal.aborted?g():new e(n.ok?"INVALID_RESPONSE":"HTTP_ERROR","The gateway returned an unreadable response",n.status,n.headers.get("X-Request-Id")??void 0)}if(o.signal.aborted)throw g();if(!d&&y!==f)throw new e("IDENTITY_CHANGED","Customer identity changed while the request was in flight");if(!n.ok){let t=D.safeParse(r),c=t.success&&(!P.safeParse(t.data.error.code).success||C(t.data.error.code,n.status)),N=c?t.data.error.code:"HTTP_ERROR",_=j(N,n.status,{retryAfter:n.headers.get("Retry-After"),recovery:c?t.data.error.recovery:void 0,reason:c?t.data.error.reason:void 0});throw new e(N,c?t.data.error.message:"Indiana request failed",n.status,n.headers.get("X-Request-Id")??(t.success?t.data.requestId:void 0),{..._,...t.success&&t.data.error.retryable===!1?{retryable:!1}:{},..._.retryAfterSeconds===void 0&&t.success&&t.data.error.retryAfterSeconds!==void 0?{retryAfterSeconds:t.data.error.retryAfterSeconds}:{}})}if(n.headers.get(E)!==R.current)throw new e("PROTOCOL_MISMATCH","Response protocol does not match this SDK");if(s&&r!==H){let t=r&&typeof r=="object"&&"scope"in r?r:r&&typeof r=="object"&&"configuration"in r?r.configuration:null;if(!t||typeof t!="object"||!("scope"in t))throw new e("INVALID_RESPONSE","Response is missing its App/environment scope");let c=b.safeParse(t.scope);if(!c.success||c.data.projectId!==s.projectId||c.data.environment!==s.environment)throw new e("SCOPE_MISMATCH","Response scope does not match this SDK instance")}let I=n.headers.get("X-Indiana-Telemetry-Subject");if(I){if(!/^[a-f0-9]{64}$/.test(I))throw new e("INVALID_RESPONSE","Invalid telemetry identity");h!==I&&(h=I,q?.(h))}return r};try{return await Promise.race([$(),F])}catch(n){throw!d&&y!==f?new e("IDENTITY_CHANGED","Customer identity changed while the request was in flight"):n instanceof e?n:new e(o.signal.aborted?"TIMEOUT":"NETWORK_ERROR",o.signal.aborted?"Indiana request timed out":"Unable to read the Indiana response")}finally{clearTimeout(X),o.signal.removeEventListener("abort",S),w.delete(o)}}return{subjectKey:()=>h,identify(a){if(!a.trim()||/\s/.test(a)||a.length>4096)throw new e("INVALID_TOKEN","A nonempty server-issued token is required");O(),m=a},reset:O,request:K}}export{Q as a};