@tinkerlandai/longplay-react-native 0.10.8 → 0.10.13

package/native-sdk/android/java/ai/tinkerland/indiana/BundledWebView.kt

@@ -66,14 +66,18 @@ internal class IndianaBundledWebView(
         val message = try { JSONObject(raw) } catch (_: Exception) { return }
         if (message.keys().asSequence().toSet() != setOf("id", "method", "payload")) return
         val id = try { UUID.fromString(message.getString("id")) } catch (_: Exception) { return }
-        if (requests.size >= 8 || !requests.add(id)) return
+        if (message.opt("method") !is String || requests.contains(id)) return
+        if (requests.size >= 8) {
+            send(JSONObject().put("id",id.toString()).put("error",JSONObject().put("code","NATIVE_BUSY").put("status",429))); return
+        }
+        requests.add(id)
         work.launch {
             try {
                 val result = dispatch(message.getString("method"), message.opt("payload"))
                 send(JSONObject().put("id", id.toString()).put("result", result ?: JSONObject.NULL))
             } catch (error: Exception) {
                 if (!stopped) {
-                    val detail = JSONObject().put("code", if (error is IndianaClientException) error.code else "NATIVE_OPERATION_FAILED")
+                    val detail = JSONObject().put("code", if (error is IndianaClientException) { if (error.code == "command_pending") "COMMAND_PENDING" else error.code } else "NATIVE_OPERATION_FAILED")
                     if (error is IndianaClientException) error.code.removePrefix("request_failed_").toIntOrNull()?.let { detail.put("status", it) }
                     send(JSONObject().put("id", id.toString()).put("error", detail)); onError(error)
                 }

package/native-sdk/android/java/ai/tinkerland/indiana/CustomerSession.kt

@@ -4,12 +4,17 @@ import java.time.Instant
 import java.util.UUID
 import java.util.concurrent.atomic.AtomicReference
 import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
 import org.json.JSONObject
+private val sessionAccessPattern = Regex("gg_ct_[A-Za-z0-9_-]{43}")
+private val sessionRefreshPattern = Regex("gg_rt_[A-Za-z0-9_-]{43}")
+private val hostAccessPattern = Regex("gg_ct_[A-Za-z0-9_-]{32,128}")
 
 /** Server-issued credentials. This SDK keeps the pair in memory only. */
 data class IndianaCustomerSession(val customerId: UUID, val sessionId: UUID, val accessToken: String, val refreshToken: String, val expiresAt: Instant, val refreshExpiresAt: Instant) {
     internal fun validate(fresh: Boolean = false) {
-        if (!accessToken.matches(Regex("gg_ct_[A-Za-z0-9_-]{43}")) || !refreshToken.matches(Regex("gg_rt_[A-Za-z0-9_-]{43}")) || refreshExpiresAt < expiresAt || refreshExpiresAt <= Instant.now() || (fresh && expiresAt <= Instant.now())) throw IndianaClientException("invalid_response")
+        if (!sessionAccessPattern.matches(accessToken) || !sessionRefreshPattern.matches(refreshToken) || refreshExpiresAt < expiresAt || refreshExpiresAt <= Instant.now() || (fresh && expiresAt <= Instant.now())) throw IndianaClientException("invalid_response")
     }
     companion object {
         @JvmStatic fun fromJSON(value: JSONObject): IndianaCustomerSession = safe { IndianaCustomerSession(UUID.fromString(value.getString("customerId")), UUID.fromString(value.getString("sessionId")), value.getString("accessToken"), value.getString("refreshToken"), Instant.parse(value.getString("expiresAt")), Instant.parse(value.getString("refreshExpiresAt"))) }.also { it.validate() }
@@ -57,12 +62,13 @@ internal class IndianaSessionTransport(private val upstream: IndianaHTTP, privat
         val pair = current.pair ?: throw IndianaClientException("unauthenticated")
         try {
             val result = upstream.send("customer-sessions/refresh", "POST", pair.refreshToken, JSONObject())
+            currentCoroutineContext().ensureActive()
             if (safe { scope(result.getJSONObject("scope")) } != expectedScope) throw IndianaClientException("scope_mismatch")
             val next = IndianaCustomerSession.fromJSON(result); next.validate(true)
             if (next.customerId != pair.customerId || next.sessionId != pair.sessionId) throw IndianaClientException("scope_mismatch")
             if (!state.compareAndSet(current, current.copy(pair = next))) throw IndianaClientException("identity_changed")
             flight.result.complete(next); return next
-        } catch (cause: Exception) {
+        } catch (cause: Throwable) {
             val error = if (state.get().epoch != current.epoch) IndianaClientException("identity_changed") else cause
             if (error is IndianaClientException && error.code == "request_failed_401") invalidate(current)
             flight.result.completeExceptionally(error); throw error
@@ -74,7 +80,7 @@ internal class IndianaSessionTransport(private val upstream: IndianaHTTP, privat
             if (current.original == null) throw IndianaClientException("unauthenticated")
             val token = provider()
             if (state.get().epoch != current.epoch) throw IndianaClientException("identity_changed")
-            if (!token.matches(Regex("gg_ct_[A-Za-z0-9_-]{43}"))) throw IndianaClientException("invalid_response")
+            if (!hostAccessPattern.matches(token)) throw IndianaClientException("invalid_response")
             return token
         }
         if (current.pair != null && current.pair.expiresAt <= now().plusSeconds(30)) refresh(false)

package/native-sdk/android/java/ai/tinkerland/indiana/FeatureClient.kt

@@ -7,19 +7,54 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.withContext
-import kotlinx.coroutines.withTimeout
+import kotlinx.coroutines.withTimeoutOrNull
 import org.json.JSONObject
 import java.util.UUID
 
+/**
+ * Readiness and pending calls of one evaluator host, confined to the main thread. Stopping fails every waiter with
+ * its cause: `identity_changed` only for an identity change or close, otherwise the host's actual failure.
+ */
+internal class IndianaFeatureCalls {
+    private val readiness = CompletableDeferred<Unit>()
+    private val pending = mutableMapOf<UUID, CompletableDeferred<Any?>>()
+    var failure: IndianaClientException? = null
+        private set
+    val ready: Boolean get() = readiness.isCompleted && failure == null
+    fun markReady() { failure?.let { throw it }; readiness.complete(Unit) }
+    /** Returns false when already stopped; the first cause wins. */
+    fun stop(cause: IndianaClientException): Boolean {
+        if (failure != null) return false
+        failure = cause; readiness.completeExceptionally(cause)
+        pending.values.forEach { it.completeExceptionally(cause) }; pending.clear(); return true
+    }
+    suspend fun call(send: (UUID) -> Unit): Any? {
+        failure?.let { throw it }
+        withTimeoutOrNull(45_000) { readiness.await() } ?: throw IndianaClientException("temporary_unavailable")
+        failure?.let { throw it }
+        val id = UUID.randomUUID(); val result = CompletableDeferred<Any?>(); pending[id] = result
+        try {
+            send(id)
+            val settled = withTimeoutOrNull(45_000) { arrayOf(result.await()) } ?: throw IndianaClientException("temporary_unavailable")
+            return settled[0]
+        } finally { pending.remove(id) }
+    }
+    fun settle(id: UUID, result: Any?, failed: Boolean) {
+        val response = pending.remove(id) ?: return
+        if (failed) response.completeExceptionally(IndianaClientException("invalid_response")) else response.complete(result)
+    }
+}
+
 /** Customer-scoped GB evaluator using the packaged official engine, without JS credentials. */
 class IndianaFeatureClient internal constructor(private val activity: Activity, private val configuration: IndianaConfiguration, attributes: JSONObject, private val operation: suspend (IndianaCustomerOperation, JSONObject) -> JSONObject) {
     private val attributes = JSONObject(attributes.toString())
     private val work = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
-    private val readiness = CompletableDeferred<Unit>()
-    private val pending = mutableMapOf<UUID, CompletableDeferred<Any?>>()
+    private val calls = IndianaFeatureCalls()
     var onError: ((Exception) -> Unit)? = null
-    private var stopped = false
-    private val host = IndianaBundledWebView(activity, "Longplay Feature evaluator", work, ::dispatch) { error -> if (!readiness.isCompleted) close() else onError?.invoke(error) }
+    private val host = IndianaBundledWebView(activity, "Longplay Feature evaluator", work, ::dispatch) { error ->
+        // Before readiness a host failure ends this client with its actual cause rather than an identity change.
+        if (!calls.ready) stop(error as? IndianaClientException ?: IndianaClientException("renderer_failed")) else onError?.invoke(error)
+    }
     init { host.start() }
     suspend fun evalFeature(key: String): JSONObject {
         val result = call(JSONObject().put("method", "evalFeature").put("key", key)) as? JSONObject ?: throw IndianaClientException("invalid_response")
@@ -31,34 +66,23 @@ class IndianaFeatureClient internal constructor(private val activity: Activity,
     suspend fun setAttributes(attributes: JSONObject) { call(JSONObject().put("method", "setAttributes").put("attributes", JSONObject(attributes.toString()))) }
     suspend fun refresh() { call(JSONObject().put("method", "refresh")) }
     suspend fun flush() { call(JSONObject().put("method", "flush")) }
-    fun close() { activity.runOnUiThread {
-        if (!stopped) {
-            stopped = true; host.destroy()
-            val error = IndianaClientException("identity_changed")
-            readiness.completeExceptionally(error); pending.values.forEach { it.completeExceptionally(error) }; pending.clear(); work.cancel()
-        }
-    } }
+    fun close() { activity.runOnUiThread { stop(IndianaClientException("identity_changed")) } }
+    private fun stop(cause: IndianaClientException) { if (calls.stop(cause)) { host.destroy(); work.cancel() } }
     private suspend fun call(input: JSONObject): Any? = withContext(Dispatchers.Main.immediate) {
-        if (stopped) throw IndianaClientException("identity_changed")
-        withTimeout(45_000) { readiness.await() }
-        if (stopped) throw IndianaClientException("identity_changed")
-        val id = UUID.randomUUID(); val result = CompletableDeferred<Any?>(); pending[id] = result
-        try { host.send(JSONObject().put("event", "feature_call").put("id", id.toString()).put("input", input)); withTimeout(45_000) { result.await() } }
-        finally { pending.remove(id) }
+        calls.call { id -> host.send(JSONObject().put("event", "feature_call").put("id", id.toString()).put("input", input)) }
     }
     private suspend fun dispatch(method: String, raw: Any?): Any? = when (method) {
         "ready" -> { host.send(JSONObject().put("event", "init").put("surface", "features").put("scope", JSONObject().put("projectId", configuration.scope.projectId.toString()).put("environment", configuration.scope.environment.value)).put("apiOrigin", configuration.apiOrigin).put("attributes", attributes)); null }
         "featureOperation" -> {
             val value = raw as? JSONObject ?: throw IndianaClientException("invalid_command")
             val name = value.getString("operation")
-            if (stopped || name !in setOf("getFeatures", "evaluateFeatures", "trackEvents")) throw IndianaClientException("invalid_command")
+            if (calls.failure != null || name !in setOf("getFeatures", "evaluateFeatures", "trackEvents")) throw IndianaClientException("invalid_command")
             operation(IndianaCustomerOperation.valueOf(name), value.getJSONObject("input"))
         }
-        "featuresReady" -> { if (stopped) throw IndianaClientException("identity_changed"); readiness.complete(Unit); null }
+        "featuresReady" -> { calls.markReady(); null }
         "featureResult" -> {
             val value = raw as? JSONObject ?: throw IndianaClientException("invalid_command")
-            val response = pending.remove(UUID.fromString(value.getString("id")))
-            if (value.has("error")) response?.completeExceptionally(IndianaClientException("invalid_response")) else response?.complete(value.opt("result")); null
+            calls.settle(UUID.fromString(value.getString("id")), value.opt("result"), value.has("error")); null
         }
         else -> throw IndianaClientException("invalid_command")
     }

package/native-sdk/android/java/ai/tinkerland/indiana/FunnelConfigurationRelay.kt

@@ -1,7 +1,11 @@
 package ai.tinkerland.indiana
 
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.CancellationException
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+import kotlin.coroutines.EmptyCoroutineContext
 import org.json.JSONObject
 import java.io.ByteArrayOutputStream
 import java.net.HttpURLConnection
@@ -18,28 +22,50 @@ internal class IndianaFunnelConfigurationRelay(private val configuration: Indian
         val request = payload as? JSONObject
         val path = request?.opt("path") as? String
         if (request == null || request.length() != 1 || path == null || !PATH.matches(path)) throw IndianaClientException("invalid_command")
-        return withContext(Dispatchers.IO) {
+        return suspendCancellableCoroutine { continuation ->
             val connection = origin.resolve(path).toURL().openConnection() as HttpURLConnection
-            try {
-                connection.requestMethod = "GET"; connection.instanceFollowRedirects = false; connection.useCaches = path.contains("/artifacts/")
-                connection.connectTimeout = configuration.timeoutMs; connection.readTimeout = configuration.timeoutMs
-                val status = connection.responseCode
-                val headers = JSONObject()
-                for ((key, values) in connection.headerFields) {
-                    val name = key?.lowercase() ?: continue
-                    if (name in HEADERS && values.isNotEmpty()) headers.put(name, values.joinToString(", "))
+            // Do not run potentially blocking disconnect on the cancelling caller.
+            continuation.invokeOnCancellation {
+                Dispatchers.IO.dispatch(EmptyCoroutineContext, Runnable { connection.disconnect() })
+            }
+            Dispatchers.IO.dispatch(continuation.context, Runnable {
+                if (!continuation.isActive) return@Runnable
+                try {
+                    connection.requestMethod = "GET"; connection.instanceFollowRedirects = false; connection.useCaches = path.contains("/artifacts/")
+                    connection.connectTimeout = configuration.timeoutMs; connection.readTimeout = configuration.timeoutMs
+                    val status = connection.responseCode
+                    val headers = JSONObject()
+                    for ((key, values) in connection.headerFields) {
+                        val name = key?.lowercase() ?: continue
+                        if (name in HEADERS && values.isNotEmpty()) headers.put(name, values.joinToString(", "))
+                    }
+                    // The shell reports other statuses (including 429 Retry-After) by status alone.
+                    val body = if (status in 200..299) {
+                        if ((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0) > MAX_BYTES) throw IndianaClientException("invalid_response")
+                        val output = ByteArrayOutputStream()
+                        connection.inputStream.use { input ->
+                            val buffer = ByteArray(8192)
+                            while (true) {
+                                if (!continuation.isActive) throw CancellationException()
+                                val size = input.read(buffer)
+                                if (size < 0) break
+                                if (output.size() + size > MAX_BYTES) throw IndianaClientException("invalid_response")
+                                output.write(buffer, 0, size)
+                            }
+                        }
+                        try { Charsets.UTF_8.newDecoder().onMalformedInput(CodingErrorAction.REPORT).onUnmappableCharacter(CodingErrorAction.REPORT).decode(ByteBuffer.wrap(output.toByteArray())).toString() }
+                        catch (_: Exception) { throw IndianaClientException("invalid_response") }
+                    } else ""
+                    continuation.resume(JSONObject().put("status", status).put("headers", headers).put("body", body))
+                } catch (error: Throwable) {
+                    continuation.resumeWithException(when (error) {
+                        is IndianaClientException, is CancellationException -> error
+                        is Exception -> IndianaClientException("temporary_unavailable")
+                        else -> error
+                    })
                 }
-                // The shell reports other statuses (including 429 Retry-After) by status alone.
-                val body = if (status in 200..299) {
-                    if ((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0) > MAX_BYTES) throw IndianaClientException("invalid_response")
-                    val output = ByteArrayOutputStream()
-                    connection.inputStream.use { input -> val buffer = ByteArray(8192); while (true) { val size = input.read(buffer); if (size < 0) break; if (output.size() + size > MAX_BYTES) throw IndianaClientException("invalid_response"); output.write(buffer, 0, size) } }
-                    try { Charsets.UTF_8.newDecoder().onMalformedInput(CodingErrorAction.REPORT).onUnmappableCharacter(CodingErrorAction.REPORT).decode(ByteBuffer.wrap(output.toByteArray())).toString() }
-                    catch (_: Exception) { throw IndianaClientException("invalid_response") }
-                } else ""
-                JSONObject().put("status", status).put("headers", headers).put("body", body)
-            } catch (e: IndianaClientException) { throw e } catch (_: Exception) { throw IndianaClientException("temporary_unavailable") }
-            finally { connection.disconnect() }
+                finally { connection.disconnect() }
+            })
         }
     }
     companion object {

package/native-sdk/android/java/ai/tinkerland/indiana/FunnelProcess.kt

@@ -0,0 +1,120 @@
+package ai.tinkerland.indiana
+
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+import java.util.UUID
+import java.util.concurrent.atomic.AtomicReference
+
+/** Uses the merchant's acknowledged process handle and authenticated session; the backend resolves the Customer. */
+interface IndianaFunnelProcessBridge {
+    suspend fun invoke(operation: String, input: JSONObject): JSONObject
+    suspend fun detach()
+}
+
+/** Owns one credential-free process command journal. The backend owns Customer/Guest credentials and refresh. */
+class IndianaFunnelProcess(
+    private val configuration: IndianaConfiguration,
+    private val bridge: IndianaFunnelProcessBridge,
+    private val commandStorage: IndianaFunnelCommandStorage,
+    private val onAuthenticationRequired: ((JSONObject) -> Unit)? = null,
+) {
+    private val epoch = AtomicReference(UUID.randomUUID())
+    private val view = AtomicReference<JSONObject?>(null)
+    private val stateLock = Any()
+    private var runToken: String? = null
+    private var presentation: IndianaFunnelSession? = null
+    val current: JSONObject? get() = view.get()?.let { JSONObject(it.toString()) }
+    private suspend fun record(): JSONObject = withContext(Dispatchers.IO) { commandStorage.read().entry?.let(::JSONObject) ?: JSONObject() }
+    private suspend fun update(change: (JSONObject) -> JSONObject) = withContext(Dispatchers.IO) {
+        for (attempt in 0 until 8) {
+            val saved=commandStorage.read();val record=saved.entry?.let(::JSONObject) ?: JSONObject();val next=change(JSONObject(record.toString()))
+            if (IndianaSchema.equal(record,next) || commandStorage.write(saved.revision,next.toString()) != null) return@withContext
+        }
+        throw IndianaClientException("command_pending")
+    }
+    private suspend fun accept(raw: JSONObject, original: UUID): JSONObject {
+        if (epoch.get()!=original) throw IndianaClientException("identity_changed")
+        val reply=JSONObject(raw.toString());IndianaSchema.validate("processResponse",reply)
+        val run=reply.getJSONObject("run");val identity=run.getJSONObject("identity");val scope=reply.getJSONObject("scope")
+        if(scope.getString("projectId")!=configuration.scope.projectId.toString() || scope.getString("environment")!=configuration.scope.environment.value) throw IndianaClientException("scope_mismatch")
+        val tuple=JSONObject().put("scope",scope).put("runId",run.getString("id")).put("source",run.getJSONObject("source"))
+            .put("participantId",identity.getString("participantId")).put("startedAs",identity.getString("startedAs")).put("runExpiresAt",run.getString("runExpiresAt"))
+        val binding: Any=identity.optJSONObject("binding")?.getString("id") ?: JSONObject.NULL
+        update { saved ->
+            saved.optJSONObject("origin")?.let { if(!IndianaSchema.equal(it,tuple)) throw IndianaClientException("invalid_response") }
+            if(saved.has("bindingId") && !saved.isNull("bindingId") && saved.get("bindingId")!=binding) throw IndianaClientException("identity_changed")
+            saved.put("origin",tuple).put("bindingId",binding)
+            reply.optJSONObject("settlement")?.takeIf { it.optString("state")=="settled" }?.let { settlement ->
+                for(lane in listOf("pending","close")) if(saved.optJSONObject(lane)?.optJSONObject("command")?.optString("requestId")==settlement.optString("requestId")) saved.remove(lane)
+            }
+            saved
+        }
+        synchronized(stateLock) {
+            if(epoch.get()!=original) throw IndianaClientException("identity_changed")
+            if(view.get()==null || run.getLong("revision")>=view.get()!!.getLong("revision")) view.set(JSONObject(run.toString()))
+            if(reply.has("runToken")) {val token=reply.getString("runToken");if(runToken!=null && runToken!=token) throw IndianaClientException("invalid_response");runToken=token}
+        }
+        if(run.optJSONObject("instruction")?.optString("type")=="authentication_required") onAuthenticationRequired?.invoke(JSONObject(run.toString()))
+        return reply
+    }
+    private suspend fun invoke(operation: String,input: JSONObject): JSONObject {
+        val original=epoch.get()
+        try {return accept(bridge.invoke(operation,JSONObject(input.toString())),original)}
+        catch(error: IndianaClientException) {
+            if(error.code in setOf("identity_changed","unauthenticated","customer_binding_conflict","request_failed_401")) synchronized(stateLock){view.set(null);presentation?.reset();presentation=null}
+            throw error
+        }
+    }
+    suspend fun open(input: JSONObject): JSONObject {
+        IndianaSchema.validate("processOpen",input);invoke("open",input);settlePending();return invoke("get",JSONObject())
+    }
+    suspend fun syncIdentity(): JSONObject {
+        invoke("syncIdentity",JSONObject());settlePending();val result=invoke("get",JSONObject());presentation?.get();return result
+    }
+    suspend fun get(input: JSONObject = JSONObject()): JSONObject {
+        val request=JSONObject(input.toString());val saved=record()
+        if(request.has("settlementRequestId")) for(lane in listOf("pending","close")) saved.optJSONObject(lane)?.let {
+            if(it.getJSONObject("command").getString("requestId")==request.getString("settlementRequestId")) request.put("settlementBindingId",it.get("bindingId"))
+        }
+        return invoke("get",request)
+    }
+    suspend fun command(command: JSONObject): JSONObject {
+        IndianaSchema.validate("processMutation",command);val run=current ?: throw IndianaClientException("invalid_command")
+        val original=epoch.get();val lane=if(command.getString("operation")=="close") "close" else "pending"
+        val envelope=JSONObject().put("command",JSONObject(command.toString())).put("bindingId",run.getJSONObject("identity").optJSONObject("binding")?.getString("id") ?: JSONObject.NULL)
+        var accepted=envelope
+        update { saved ->
+            saved.optJSONObject(lane)?.let { pending ->
+                if(!IndianaSchema.equal(pending.getJSONObject("command"),command)) throw IndianaClientException("command_pending")
+                accepted=JSONObject(pending.toString())
+            } ?: saved.put(lane,envelope)
+            saved
+        }
+        if(epoch.get()!=original) throw IndianaClientException("identity_changed")
+        return invoke("command",accepted)
+    }
+    private suspend fun settlePending() {
+        val saved=record()
+        for(lane in listOf("pending","close")) saved.optJSONObject(lane)?.let {
+            get(JSONObject().put("settlementRequestId",it.getJSONObject("command").getString("requestId")).put("settlementBindingId",it.get("bindingId")))
+        }
+    }
+    /** Reuses the native renderer; this process remains the sole command journal owner. */
+    fun presentationSession(): IndianaFunnelSession = synchronized(stateLock) {
+        presentation ?: IndianaFunnelSession(configuration,object: IndianaHTTP {
+            override suspend fun send(path: String,method: String,authorization: String,body: JSONObject?): JSONObject {
+                if(path!="funnels" || method!="POST" || body==null) throw IndianaClientException("invalid_command")
+                val input=JSONObject(body.toString());input.remove("customerToken");val operation=input.getString("operation")
+                val reply=when(operation){"get"->{input.remove("operation");get(input)};"review"->{input.remove("operation");invoke("review",input)};else->command(input)}
+                reply.remove("contract");val run=reply.getJSONObject("run");val identity=run.getJSONObject("identity");run.remove("identity");run.put("authenticated",!identity.isNull("binding"))
+                if(run.optJSONObject("instruction")?.optString("type")=="authentication_required")run.put("instruction",JSONObject.NULL)
+                reply.optJSONObject("settlement")?.remove("accepted");return reply
+            }
+        },runToken ?: throw IndianaClientException("invalid_command")).also { presentation=it }
+    }
+    suspend fun detach() {
+        synchronized(stateLock){epoch.set(UUID.randomUUID());view.set(null);presentation?.reset();presentation=null;runToken=null}
+        bridge.detach()
+    }
+}

package/native-sdk/android/java/ai/tinkerland/indiana/FunnelSession.kt

@@ -25,6 +25,7 @@ class IndianaFunnelSession internal constructor(private val configuration: India
     private val settlements = java.util.concurrent.ConcurrentHashMap<String,String>()
     @Volatile private var closeRequested = false
     private val mutex = Mutex()
+    private val closeMutex = Mutex()
     private val responseMutex = Mutex()
     private val responseState = Any()
     @Volatile private var invalidated = false
@@ -51,16 +52,20 @@ class IndianaFunnelSession internal constructor(private val configuration: India
             if (restored) return@withLock
             val actor = identity.get();val record = journal.load()
             if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
-            pending.set(record?.optJSONObject("command")?.toString());closingCommand.set(record?.optJSONObject("closeCommand")?.toString());purchaseRecovery.set(record?.optJSONObject("purchase"))
-            closeRequested = record?.optBoolean("closed") == true || record?.optJSONObject("command")?.optString("operation") == "close"
+            val command = record?.optJSONObject("command")
+            pending.set(command?.takeIf { it.optString("operation") != "close" }?.toString())
+            closingCommand.set((command?.takeIf { it.optString("operation") == "close" } ?: record?.optJSONObject("closeCommand"))?.toString())
+            purchaseRecovery.set(record?.optJSONObject("purchase"))
+            closeRequested = record?.optBoolean("closed") == true || closingCommand.get() != null
             for (command in listOf(pending.get(),closingCommand.get())) command?.let { uncertain.add(JSONObject(it).getString("requestId")) }
             restored = true
         }
     }
-    private suspend fun call(command: JSONObject): JSONObject {
+    private suspend fun call(command: JSONObject, expectedEpoch: UUID? = null): JSONObject {
         restoreCommands()
         if (invalidated) throw IndianaClientException("identity_changed")
         val actor = identity.get();val body = JSONObject(command.toString());actor.token?.let { body.put("customerToken", it) }
+        if (expectedEpoch != null && expectedEpoch != actor.epoch) throw IndianaClientException("identity_changed")
         if (body.toString().toByteArray(Charsets.UTF_8).size > 262144) throw IndianaClientException("invalid_command")
         IndianaSchema.validate("command", body)
         val next = http.send("funnels", "POST", runToken, body)
@@ -112,33 +117,69 @@ class IndianaFunnelSession internal constructor(private val configuration: India
     suspend fun get(data: JSONObject? = null, purchase: JSONObject? = null): JSONObject { restoreCommands(); val command = JSONObject().put("operation", "get");data?.let { command.put("data", it) };val reference = purchase ?: purchaseRecovery.get()?.let { JSONObject().put("receiptId",it.getString("receiptId")).put("operationId",it.getString("operationId")) };reference?.let { command.put("purchase",it) };return call(command) }
     private suspend fun mutate(command: JSONObject): JSONObject {
         restoreCommands()
-        val original = command.toString();val closing = command.optString("operation") == "close";val id = command.optString("requestId")
-        if (!closing && closeRequested) throw IndianaClientException("command_pending")
-        suspend fun dispatch(): JSONObject {
+        val actor = identity.get()
+        val original = command.toString()
+        val closing = command.optString("operation") == "close"
+        val id = command.optString("requestId")
+        val lane = if (closing) closeMutex else mutex
+        if (!lane.tryLock()) throw IndianaClientException("command_pending")
+        try {
             val slot = if (closing) closingCommand else pending
-            val prior = slot.get();if (prior != null && !IndianaSchema.equal(JSONObject(prior), command)) throw IndianaClientException("command_pending")
-            slot.set(original);val wasUncertain = !uncertain.add(id)
+            val wasUncertain = synchronized(responseState) {
+                if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                if (!closing && closeRequested) throw IndianaClientException("command_pending")
+                if (closing && pending.get()?.let { JSONObject(it).optString("requestId") } == id) throw IndianaClientException("invalid_command")
+                val prior = slot.get()
+                if (prior != null && !IndianaSchema.equal(JSONObject(prior), command)) throw IndianaClientException("command_pending")
+                slot.set(original)
+                if (closing) closeRequested = true
+                uncertain.contains(id)
+            }
             try {
                 journal?.let { it.retain(command,current ?: throw IndianaClientException("invalid_command")) }
-                return call(command).also {
+                synchronized(responseState) {
+                    if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                    uncertain.add(id)
+                }
+                return call(command, actor.epoch).also {
                     val state = settlements[id]
-                    if (it.optJSONObject("pendingRequest")?.optString("requestId") != id && state == "settled" && (!closeRequested || closing || it.optString("status") !in setOf("running","waiting"))) { journal?.settle(id);slot.compareAndSet(original,null);uncertain.remove(id) }
+                    if (it.optJSONObject("pendingRequest")?.optString("requestId") != id && state == "settled" && (!closeRequested || closing || it.optString("status") !in setOf("running","waiting"))) {
+                        journal?.settle(id)
+                        synchronized(responseState) {
+                            if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                            slot.compareAndSet(original,null);uncertain.remove(id)
+                        }
+                    }
+                    if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
                 }
             } catch (error: Exception) {
                 val code = (error as? IndianaClientException)?.code?.removePrefix("request_failed_")?.toIntOrNull()
-                if (!wasUncertain && !closeRequested && code != null && code < 500 && code !in setOf(401,425)) { journal?.settle(id);slot.compareAndSet(original,null);uncertain.remove(id) };throw error
+                if (!invalidated && identity.get().epoch == actor.epoch && !wasUncertain && code != null && code < 500 && code !in setOf(401,425)) {
+                    journal?.settle(id)
+                    synchronized(responseState) {
+                        if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                        slot.compareAndSet(original,null);uncertain.remove(id)
+                    }
+                }
+                throw error
             }
+        } finally {
+            lane.unlock()
         }
-        if (closing) { closeRequested = true;return dispatch() }
-        return mutex.withLock { dispatch() }
     }
     suspend fun settle(requestId: UUID): JSONObject {
+        restoreCommands()
+        val actor = identity.get()
         val id = requestId.toString();settlements.remove(id)
-        val result = call(JSONObject().put("operation","get").put("settlementRequestId",id))
-        if (settlements[id] == "settled") {
+        val result = call(JSONObject().put("operation","get").put("settlementRequestId",id), actor.epoch)
+        if (settlements[id] == "settled" && result.optJSONObject("pendingRequest")?.optString("requestId") != id) {
             journal?.settle(id)
-            for (slot in listOf(pending,closingCommand)) { val old = slot.get();if (old != null && JSONObject(old).optString("requestId") == id) slot.compareAndSet(old,null) };uncertain.remove(id)
+            synchronized(responseState) {
+                if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
+                for (slot in listOf(pending,closingCommand)) { val old = slot.get();if (old != null && JSONObject(old).optString("requestId") == id) slot.compareAndSet(old,null) };uncertain.remove(id)
+            }
         }
+        if (invalidated || identity.get().epoch != actor.epoch) throw IndianaClientException("identity_changed")
         return result
     }
     private fun base(operation: String, requestId: UUID): JSONObject { val run = current ?: throw IndianaClientException("invalid_command");return JSONObject().put("operation", operation).put("requestId", requestId.toString()).put("nodeId", run.getString("nodeId")).put("visit", run.getInt("visit")).put("revision", run.getInt("revision")) }

package/native-sdk/android/java/ai/tinkerland/indiana/GoogleStorefront.kt

@@ -73,10 +73,27 @@ data class GoogleStoreTerms(val productKind: String, val offerKind: String, val
 }
 sealed interface GoogleStoreResult {
     data class Purchased(val evidence: GooglePurchaseEvidence): GoogleStoreResult
+    /** The Play flow ended without a purchase: the user dismissed it, or Play refused the payment and showed why. */
     data object Canceled: GoogleStoreResult
     data class Failed(val code: String): GoogleStoreResult
 }
 
+/**
+ * Classifies a Play purchase flow that ended without a purchase. A refused payment ends like a dismissed sheet, as
+ * StoreKit reports it after its own payment sheet. Only lost Play connections and internal errors, whose purchase
+ * state is unknown, report `store_unavailable`.
+ */
+internal fun googleFlowEnded(responseCode: Int, subResponseCode: Int): GoogleStoreResult = when {
+    responseCode == BillingClient.BillingResponseCode.USER_CANCELED -> GoogleStoreResult.Canceled
+    // Google documents BILLING_UNAVAILABLE in a purchase result as a user billing error, including a refused charge.
+    responseCode == BillingClient.BillingResponseCode.BILLING_UNAVAILABLE ||
+        subResponseCode == BillingClient.OnPurchasesUpdatedSubResponseCode.PAYMENT_DECLINED_DUE_TO_INSUFFICIENT_FUNDS ||
+        subResponseCode == BillingClient.OnPurchasesUpdatedSubResponseCode.USER_INELIGIBLE -> GoogleStoreResult.Canceled
+    responseCode == BillingClient.BillingResponseCode.ITEM_UNAVAILABLE -> GoogleStoreResult.Failed("product_unavailable")
+    responseCode in setOf(BillingClient.BillingResponseCode.DEVELOPER_ERROR, BillingClient.BillingResponseCode.ITEM_ALREADY_OWNED, BillingClient.BillingResponseCode.ITEM_NOT_OWNED) -> GoogleStoreResult.Failed("purchase_not_started")
+    else -> GoogleStoreResult.Failed("store_unavailable")
+}
+
 /** The backend owns acknowledge/consume. Purchase callbacks never grant customer access. */
 class GoogleStorefront(context: Context, private val onResult: (GoogleStoreResult) -> Unit) : IndianaGoogleStore {
     private val client = BillingClient.newBuilder(context.applicationContext)
@@ -86,8 +103,7 @@ class GoogleStorefront(context: Context, private val onResult: (GoogleStoreResul
                     if (purchase.products.size != 1 || purchase.quantity != 1 || purchase.purchaseState !in listOf(Purchase.PurchaseState.PURCHASED, Purchase.PurchaseState.PENDING)) onResult(GoogleStoreResult.Failed("unsupported_purchase"))
                     else onResult(GoogleStoreResult.Purchased(GooglePurchaseEvidence(purchase.products.single(),purchase.purchaseToken,purchase.purchaseState == Purchase.PurchaseState.PENDING,purchase.accountIdentifiers?.obfuscatedAccountId,purchase.accountIdentifiers?.obfuscatedProfileId)))
                 }
-                BillingClient.BillingResponseCode.USER_CANCELED -> onResult(GoogleStoreResult.Canceled)
-                else -> onResult(GoogleStoreResult.Failed("store_unavailable"))
+                else -> onResult(googleFlowEnded(result.responseCode, result.onPurchasesUpdatedSubResponseCode))
             }
         }
         .enablePendingPurchases(PendingPurchasesParams.newBuilder().enableOneTimeProducts().build())

package/native-sdk/android/java/ai/tinkerland/indiana/HTTPTransport.kt

@@ -1,7 +1,11 @@
 package ai.tinkerland.indiana
 
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.CancellationException
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+import kotlin.coroutines.EmptyCoroutineContext
 import org.json.JSONObject
 import java.net.URI
 import java.net.HttpURLConnection
@@ -19,25 +23,49 @@ internal interface IndianaHTTP { suspend fun send(path: String,method: String,au
 internal fun requireCurrentProtocol(value: String?) {
     if (value != IndianaProtocol.wireProtocol) throw IndianaClientException("invalid_response")
 }
-internal class IndianaURLTransport(private val configuration: IndianaConfiguration): IndianaHTTP {
-    override suspend fun send(path: String,method: String,authorization: String,body: JSONObject?): JSONObject = withContext(Dispatchers.IO) {
+internal class IndianaURLTransport(private val configuration: IndianaConfiguration, loopbackFixtureOrigin: URI? = null): IndianaHTTP {
+    // Internal loopback fixture only; public configuration remains HTTPS-only.
+    private val origin = loopbackFixtureOrigin?.also { require(it.scheme == "http" && it.host == "127.0.0.1" && it.port > 1024 && it.rawUserInfo == null && it.rawQuery == null && it.rawFragment == null && it.rawPath.isNullOrEmpty()) } ?: URI(configuration.baseUrl)
+    override suspend fun send(path: String,method: String,authorization: String,body: JSONObject?): JSONObject = suspendCancellableCoroutine { continuation ->
         require(!path.contains("..")&&!path.contains("?")&&!path.contains("#")&&!path.startsWith("/"))
-        val connection=URI(configuration.baseUrl.trimEnd('/')+"/api/v1/"+path).toURL().openConnection() as HttpURLConnection
-        try {
-            connection.requestMethod=method;connection.instanceFollowRedirects=false;connection.connectTimeout=configuration.timeoutMs;connection.readTimeout=configuration.timeoutMs;connection.useCaches=false
-            if(authorization.isNotEmpty()) connection.setRequestProperty("Authorization","Bearer $authorization")
-            connection.setRequestProperty("Content-Type","application/json")
-            connection.setRequestProperty("X-Indiana-Project",configuration.scope.projectId.toString());connection.setRequestProperty("X-Indiana-Environment",configuration.scope.environment.value)
-            connection.setRequestProperty("X-Indiana-Protocol",IndianaProtocol.wireProtocol)
-            connection.setRequestProperty("X-Indiana-SDK-Version",IndianaSDK.version)
-            if(body!=null){connection.doOutput=true;val bytes=body.toString().toByteArray(Charsets.UTF_8);connection.setFixedLengthStreamingMode(bytes.size);connection.outputStream.use {it.write(bytes)}}
-            if(connection.responseCode !in 200..299)throw IndianaClientException("request_failed_${connection.responseCode}")
-            requireCurrentProtocol(connection.getHeaderField("X-Indiana-Protocol"))
-            if((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0)>2_097_152)throw IndianaClientException("invalid_response")
-            val output=ByteArrayOutputStream()
-            connection.inputStream.use {input->val buffer=ByteArray(8192);while(true){val size=input.read(buffer);if(size<0)break;if(output.size()+size>2_097_152)throw IndianaClientException("invalid_response");output.write(buffer,0,size)}}
-            safe{JSONObject(output.toString("UTF-8"))}
-        } catch(e:IndianaClientException){throw e}catch(_:Exception){throw IndianaClientException("temporary_unavailable")}
-        finally {connection.disconnect()}
+        val connection=URI(origin.toString().trimEnd('/')+"/api/v1/"+path).toURL().openConnection() as HttpURLConnection
+        // Some implementations block in disconnect while a read owns the stream.
+        continuation.invokeOnCancellation {
+            Dispatchers.IO.dispatch(EmptyCoroutineContext, Runnable { connection.disconnect() })
+        }
+        Dispatchers.IO.dispatch(continuation.context, Runnable {
+            if (!continuation.isActive) return@Runnable
+            try {
+                connection.requestMethod=method;connection.instanceFollowRedirects=false;connection.connectTimeout=configuration.timeoutMs;connection.readTimeout=configuration.timeoutMs;connection.useCaches=false
+                if(authorization.isNotEmpty()) connection.setRequestProperty("Authorization","Bearer $authorization")
+                connection.setRequestProperty("Content-Type","application/json")
+                connection.setRequestProperty("X-Indiana-Project",configuration.scope.projectId.toString());connection.setRequestProperty("X-Indiana-Environment",configuration.scope.environment.value)
+                connection.setRequestProperty("X-Indiana-Protocol",IndianaProtocol.wireProtocol)
+                connection.setRequestProperty("X-Indiana-SDK-Version",IndianaSDK.version)
+                if(body!=null){connection.doOutput=true;val bytes=body.toString().toByteArray(Charsets.UTF_8);connection.setFixedLengthStreamingMode(bytes.size);connection.outputStream.use {it.write(bytes)}}
+                if(connection.responseCode !in 200..299)throw IndianaClientException("request_failed_${connection.responseCode}")
+                requireCurrentProtocol(connection.getHeaderField("X-Indiana-Protocol"))
+                if((connection.getHeaderField("Content-Length")?.toLongOrNull() ?: 0)>2_097_152)throw IndianaClientException("invalid_response")
+                val output=ByteArrayOutputStream()
+                connection.inputStream.use { input ->
+                    val buffer = ByteArray(8192)
+                    while (true) {
+                        if (!continuation.isActive) throw CancellationException()
+                        val size = input.read(buffer)
+                        if (size < 0) break
+                        if (output.size() + size > 2_097_152) throw IndianaClientException("invalid_response")
+                        output.write(buffer, 0, size)
+                    }
+                }
+                continuation.resume(safe{JSONObject(output.toString("UTF-8"))})
+            } catch (error: Throwable) {
+                continuation.resumeWithException(when (error) {
+                    is IndianaClientException, is CancellationException -> error
+                    is Exception -> IndianaClientException("temporary_unavailable")
+                    else -> error
+                })
+            }
+            finally {connection.disconnect()}
+        })
     }
 }