@tinkerlandai/longplay-react-native 0.10.8 → 0.10.13

package/native-sdk/ios/BundledWebView.swift

@@ -56,7 +56,11 @@ import UIKit
               let data=try? JSONSerialization.data(withJSONObject:message.body), data.count <= 262144,
               let value=try? JSONDecoder().decode(IndianaJSON.self,from:data).object,
               Set(value.keys) == Set(["id","method","payload"]), let id=value["id"]?.string.flatMap(UUID.init(uuidString:)),
-              let method=value["method"]?.string, requests.count < 8, requests.insert(id).inserted else { return }
+              let method=value["method"]?.string, !requests.contains(id) else { return }
+        guard requests.count < 8 else {
+            send(.object(["id":.string(id.uuidString.lowercased()),"error":.object(["code":.string("NATIVE_BUSY"),"status":.number(429)])])); return
+        }
+        requests.insert(id)
         Task {
             defer { requests.remove(id) }
             do {

package/native-sdk/ios/CustomerSession.swift

@@ -2,6 +2,8 @@ import Foundation
 
 /// Opaque credentials issued by the merchant backend; keep them in memory.
 public struct IndianaCustomerSession: Codable, Sendable {
+    private static let fractionalDate = Date.ISO8601FormatStyle(includingFractionalSeconds: true)
+    private static let wholeDate = Date.ISO8601FormatStyle()
     public let customerId: UUID
     public let sessionId: UUID
     public let accessToken: String
@@ -12,8 +14,7 @@ public struct IndianaCustomerSession: Codable, Sendable {
         self.customerId = customerId; self.sessionId = sessionId; self.accessToken = accessToken; self.refreshToken = refreshToken; self.expiresAt = expiresAt; self.refreshExpiresAt = refreshExpiresAt
     }
     internal func deadline(_ value: String) -> Date? {
-        let parser = ISO8601DateFormatter(); parser.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
-        return parser.date(from: value) ?? ISO8601DateFormatter().date(from: value)
+        (try? Self.fractionalDate.parse(value)) ?? (try? Self.wholeDate.parse(value))
     }
     internal func validate(fresh: Bool = false) throws {
         guard accessToken.range(of: "^gg_ct_[A-Za-z0-9_-]{43}$", options: .regularExpression) != nil,
@@ -39,6 +40,7 @@ internal actor IndianaSessionTransport: IndianaHTTP {
     init(_ upstream: any IndianaHTTP, scope: IndianaScope, now: @escaping @Sendable () -> Date = { Date() }) { self.upstream = upstream; self.scope = scope; self.now = now }
     func identify(_ access: String?, revision: UInt64? = nil, onInvalidated: (@Sendable () async -> Void)? = nil) {
         if let revision { guard revision >= identityRevision else { return }; identityRevision = revision } else { identityRevision += 1 }
+        pending?.1.cancel()
         epoch = UUID(); credentials = nil; originalAccess = access; pending = nil; self.onInvalidated = onInvalidated
     }
     func identify(_ value: IndianaCustomerSession, revision: UInt64? = nil, onInvalidated: (@Sendable () async -> Void)? = nil) throws {
@@ -54,6 +56,7 @@ internal actor IndianaSessionTransport: IndianaHTTP {
         do {
             let next = try await task.value
             guard version == epoch else { throw IndianaClientError.identityChanged }
+            try Task.checkCancellation()
             return next
         } catch {
             guard revision == identityRevision else { throw IndianaClientError.identityChanged }
@@ -62,6 +65,7 @@ internal actor IndianaSessionTransport: IndianaHTTP {
     }
     func refresh() async throws -> IndianaCustomerSession {
         guard accessProvider == nil else { throw IndianaClientError.unsupportedCapability }
+        try Task.checkCancellation()
         if let pending {
             return try await awaitRefresh(pending.1, epoch: epoch, revision: identityRevision)
         }
@@ -97,7 +101,7 @@ internal actor IndianaSessionTransport: IndianaHTTP {
             guard originalAccess != nil else { throw IndianaClientError.unauthenticated }
             let token = try await accessProvider()
             guard version == epoch else { throw IndianaClientError.identityChanged }
-            guard token.range(of: "^gg_ct_[A-Za-z0-9_-]{43}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidResponse }
+            guard token.range(of: "^gg_ct_[A-Za-z0-9_-]{32,128}$", options: .regularExpression) != nil else { throw IndianaClientError.invalidResponse }
             return token
         }
         if let current = credentials, (current.deadline(current.expiresAt) ?? .distantPast) <= now().addingTimeInterval(30) { _ = try await refresh() }

package/native-sdk/ios/FeatureClient.swift

@@ -9,6 +9,68 @@ public struct IndianaFeatureResult: Codable, Sendable {
     public let experimentResult: IndianaJSON?
 }
 
+/// Readiness and pending calls of one evaluator host, confined to the main actor. Stopping fails every waiter with its
+/// cause: `identityChanged` only for an identity change or close, otherwise the host's actual failure.
+@MainActor final class IndianaFeatureCalls {
+    private let timeout: UInt64
+    private var readinessSignalled = false
+    private var waiting: [UUID: CheckedContinuation<Void, any Error>] = [:]
+    private var pending: [UUID: CheckedContinuation<IndianaJSON, any Error>] = [:]
+    private(set) var failure: (any Error)?
+    init(timeout nanoseconds: UInt64 = 45_000_000_000) { timeout = nanoseconds }
+    var ready: Bool { readinessSignalled && failure == nil }
+    /// Calls currently waiting for readiness or a result.
+    var waiters: Int { waiting.count + pending.count }
+    /// SDK errors keep their identity; a platform failure of the packaged renderer host reports `invalidResponse`, the
+    /// renderer-failure error of the other Swift hosts.
+    static func hostFailure(_ error: any Error) -> any Error {
+        error is IndianaClientError || error is IndianaFunnelError || error is IndianaStoreError ? error : IndianaClientError.invalidResponse
+    }
+    func markReady() throws {
+        if let failure { throw failure }
+        readinessSignalled = true
+        let current = waiting; waiting = [:]; for continuation in current.values { continuation.resume() }
+    }
+    /// Returns false when already stopped; the first cause wins.
+    @discardableResult func stop(_ cause: any Error) -> Bool {
+        guard failure == nil else { return false }
+        failure = cause
+        let readiness = waiting, calls = pending; waiting = [:]; pending = [:]
+        for continuation in readiness.values { continuation.resume(throwing: cause) }
+        for continuation in calls.values { continuation.resume(throwing: cause) }
+        return true
+    }
+    /// Each wait for readiness and for the result is bounded separately; a timeout fails only this call.
+    func call(_ send: (UUID) -> Void) async throws -> IndianaJSON {
+        if let failure { throw failure }
+        let delay = timeout
+        if !readinessSignalled {
+            let waiter = UUID()
+            try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, any Error>) in
+                waiting[waiter] = continuation
+                Task { [weak self] in
+                    try? await Task.sleep(nanoseconds: delay)
+                    self?.waiting.removeValue(forKey: waiter)?.resume(throwing: IndianaClientError.temporaryUnavailable)
+                }
+            }
+        }
+        if let failure { throw failure }
+        let id = UUID()
+        return try await withCheckedThrowingContinuation { continuation in
+            pending[id] = continuation
+            send(id)
+            Task { [weak self] in
+                try? await Task.sleep(nanoseconds: delay)
+                self?.pending.removeValue(forKey: id)?.resume(throwing: IndianaClientError.temporaryUnavailable)
+            }
+        }
+    }
+    func settle(_ id: UUID, result: IndianaJSON, failed: Bool) {
+        guard let continuation = pending.removeValue(forKey: id) else { return }
+        if failed { continuation.resume(throwing: IndianaClientError.invalidResponse) } else { continuation.resume(returning: result) }
+    }
+}
+
 #if canImport(UIKit)
 import UIKit
 
@@ -19,18 +81,18 @@ import UIKit
     private let attributes: [String: IndianaJSON]
     private let operation: @Sendable (IndianaCustomerOperation, [String: IndianaJSON]) async throws -> IndianaJSON
     private var host: IndianaBundledWebView!
+    private let calls = IndianaFeatureCalls()
     public var onError: (@MainActor (Error) -> Void)?
-    private var ready = false
-    private var stopped = false
-    private var readiness: [CheckedContinuation<Void, Error>] = []
-    private var pending: [UUID: CheckedContinuation<IndianaJSON, Error>] = [:]
     init(configuration: IndianaConfiguration, attributes: [String: IndianaJSON], operation: @escaping @Sendable (IndianaCustomerOperation, [String: IndianaJSON]) async throws -> IndianaJSON) {
         self.configuration = configuration; self.attributes = attributes; self.operation = operation
         host = IndianaBundledWebView(label: "Longplay Feature evaluator", dispatch: { [weak self] method, payload in
             guard let self else { throw IndianaClientError.identityChanged }; return try await self.dispatch(method, payload)
-        }, onError: { [weak self] error in guard let self else { return }; if !self.ready { self.close() } else { self.onError?(error) } })
+        }, onError: { [weak self] error in
+            guard let self else { return }
+            // Before readiness a host failure ends this client with its actual cause rather than an identity change.
+            if !self.calls.ready { self.stop(IndianaFeatureCalls.hostFailure(error)) } else { self.onError?(error) }
+        })
         host.start()
-        Task { [weak self] in try? await Task.sleep(nanoseconds: 45_000_000_000); if let self, !self.ready { self.close() } }
     }
     public func evalFeature(_ key: String) async throws -> IndianaFeatureResult {
         let value = try await call(["method": .string("evalFeature"), "key": .string(key)])
@@ -44,41 +106,25 @@ import UIKit
     public func setAttributes(_ value: [String: IndianaJSON]) async throws { _ = try await call(["method": .string("setAttributes"), "attributes": .object(value)]) }
     public func refresh() async throws { _ = try await call(["method": .string("refresh")]) }
     public func flush() async throws { _ = try await call(["method": .string("flush")]) }
-    public func close() {
-        guard !stopped else { return }; stopped = true; host?.destroy()
-        let waiting = readiness; readiness = []; for continuation in waiting { continuation.resume(throwing: IndianaClientError.identityChanged) }
-        let calls = pending; pending = [:]; for continuation in calls.values { continuation.resume(throwing: IndianaClientError.identityChanged) }
-    }
+    public func close() { stop(IndianaClientError.identityChanged) }
+    private func stop(_ cause: any Error) { if calls.stop(cause) { host?.destroy() } }
     private func call(_ command: [String: IndianaJSON]) async throws -> IndianaJSON {
-        guard !stopped else { throw IndianaClientError.identityChanged }
-        if !ready { try await withCheckedThrowingContinuation { readiness.append($0) } }
-        guard !stopped else { throw IndianaClientError.identityChanged }
-        let id = UUID()
-        return try await withCheckedThrowingContinuation { continuation in
-            pending[id] = continuation
-            host.send(.object(["event": .string("feature_call"), "id": .string(id.uuidString.lowercased()), "input": .object(command)]))
-            Task { [weak self] in
-                try? await Task.sleep(nanoseconds: 45_000_000_000)
-                self?.pending.removeValue(forKey: id)?.resume(throwing: IndianaClientError.temporaryUnavailable)
-            }
-        }
+        try await calls.call { id in host.send(.object(["event": .string("feature_call"), "id": .string(id.uuidString.lowercased()), "input": .object(command)])) }
     }
     private func dispatch(_ method: String, _ value: IndianaJSON) async throws -> IndianaJSON {
         switch method {
         case "ready":
             host.send(.object(["event": .string("init"), "surface": .string("features"), "scope": .object(["projectId": .string(configuration.scope.projectId.uuidString.lowercased()), "environment": .string(configuration.scope.environment.rawValue)]), "apiOrigin": .string(configuration.apiOrigin), "attributes": .object(attributes)])); return .null
         case "featureOperation":
-            guard !stopped, let name = value.object?["operation"]?.string,
+            guard calls.failure == nil, let name = value.object?["operation"]?.string,
                   ["getFeatures", "evaluateFeatures", "trackEvents"].contains(name), let selected = IndianaCustomerOperation(rawValue: name),
                   let input = value.object?["input"]?.object else { throw IndianaFunnelError.invalidCommand }
             return try await operation(selected, input)
         case "featuresReady":
-            guard !stopped else { throw IndianaClientError.identityChanged }; ready = true
-            let waiting = readiness; readiness = []; for continuation in waiting { continuation.resume() }; return .null
+            try calls.markReady(); return .null
         case "featureResult":
-            guard !stopped, let id = value.object?["id"]?.string.flatMap(UUID.init(uuidString:)), let continuation = pending.removeValue(forKey: id) else { return .null }
-            if value.object?["error"] != nil { continuation.resume(throwing: IndianaClientError.invalidResponse) }
-            else { continuation.resume(returning: value.object?["result"] ?? .null) }; return .null
+            guard let id = value.object?["id"]?.string.flatMap(UUID.init(uuidString:)) else { return .null }
+            calls.settle(id, result: value.object?["result"] ?? .null, failed: value.object?["error"] != nil); return .null
         default: throw IndianaFunnelError.invalidCommand
         }
     }

package/native-sdk/ios/FunnelConfigurationRelay.swift

@@ -23,6 +23,7 @@ final class IndianaFunnelConfigurationRelay: Sendable {
         request.cachePolicy = path.contains("/artifacts/") ? .useProtocolCachePolicy : .reloadIgnoringLocalCacheData
         do {
             let (bytes, response) = try await session.bytes(for: request)
+            defer { bytes.task.cancel() }
             guard let http = response as? HTTPURLResponse else { throw IndianaClientError.temporaryUnavailable }
             var headers: [String: IndianaJSON] = [:]
             for (key, value) in http.allHeaderFields {

package/native-sdk/ios/FunnelProcess.swift

@@ -0,0 +1,148 @@
+import Foundation
+
+/// Calls the merchant backend's process adapter with its acknowledged durable handle and authenticated merchant session.
+/// The backend resolves the subject; no Server Key, Guest proof or Customer token enters this interface.
+public protocol IndianaFunnelProcessBridge: Sendable {
+    func invoke(_ operation: String, input: [String: IndianaJSON]) async throws -> Data
+    func detach() async throws
+}
+
+/// Process identity and its credential-free command journal survive Customer-session replacement.
+public actor IndianaFunnelProcess {
+    private let configuration: IndianaConfiguration
+    private let bridge: any IndianaFunnelProcessBridge
+    private let storage: any IndianaFunnelCommandStorage
+    private var epoch = UUID()
+    private var presentation: IndianaFunnelSession?
+    private var runToken: String?
+    public private(set) var current: [String: IndianaJSON]?
+    private let onAuthenticationRequired: (@Sendable ([String: IndianaJSON]) -> Void)?
+    public init(configuration: IndianaConfiguration, bridge: any IndianaFunnelProcessBridge, commandStorage: any IndianaFunnelCommandStorage,
+                onAuthenticationRequired: (@Sendable ([String: IndianaJSON]) -> Void)? = nil) {
+        self.configuration=configuration; self.bridge=bridge; storage=commandStorage; self.onAuthenticationRequired=onAuthenticationRequired
+    }
+    private func bytes(_ value: [String: IndianaJSON]) throws -> Data { try JSONEncoder().encode(value) }
+    private func update(_ change: ([String: IndianaJSON]) throws -> [String: IndianaJSON]) async throws {
+        for _ in 0..<8 {
+            let saved=try await storage.read()
+            let record=try saved.entry.map { try JSONDecoder().decode([String: IndianaJSON].self,from:$0) } ?? [:]
+            let next=try change(record)
+            if next==record { return }
+            if try await storage.write(expectedRevision:saved.revision,entry:bytes(next)) != nil { return }
+        }
+        throw IndianaFunnelError.commandPending
+    }
+    private func record() async throws -> [String: IndianaJSON] {
+        let saved=try await storage.read()
+        return try saved.entry.map { try JSONDecoder().decode([String: IndianaJSON].self,from:$0) } ?? [:]
+    }
+    private func accept(_ data: Data, epoch original: UUID) async throws -> [String: IndianaJSON] {
+        guard original==epoch else { throw IndianaFunnelError.identityChanged }
+        try IndianaSchema.validate("processResponse",data:data)
+        let reply=try JSONDecoder().decode([String: IndianaJSON].self,from:data)
+        guard let run=reply["run"]?.object, let identity=run["identity"]?.object,
+              let scope=reply["scope"], try JSONDecoder().decode(IndianaScope.self,from:JSONEncoder().encode(scope))==configuration.scope else { throw IndianaFunnelError.invalidResponse }
+        let tuple: [String: IndianaJSON] = ["scope":scope,"runId":run["id"]!,"source":run["source"]!,"participantId":identity["participantId"]!,"startedAs":identity["startedAs"]!,"runExpiresAt":run["runExpiresAt"]!]
+        let binding=identity["binding"]?.object?["id"] ?? .null
+        try await update { record in
+            var next=record
+            if let previous=record["origin"], previous != .object(tuple) { throw IndianaFunnelError.invalidResponse }
+            if let old=record["bindingId"], old != .null, binding != old { throw IndianaFunnelError.identityChanged }
+            next["origin"] = .object(tuple); next["bindingId"] = binding
+            if let settlement=reply["settlement"]?.object, settlement["state"] == .string("settled"),
+               let id=settlement["requestId"] {
+                for lane in ["pending","close"] where record[lane]?.object?["command"]?.object?["requestId"]==id { next.removeValue(forKey:lane) }
+            }
+            return next
+        }
+        guard original==epoch else { throw IndianaFunnelError.identityChanged }
+        let revision: (IndianaJSON?) -> Double = { if case .number(let n)=$0 { return n }; return -1 }
+        if current==nil || revision(run["revision"])>=revision(current?["revision"]) { current=run }
+        if let value=reply["runToken"]?.string { if let old=runToken,old != value { throw IndianaFunnelError.invalidResponse };runToken=value }
+        if run["instruction"]?.object?["type"] == .string("authentication_required") { onAuthenticationRequired?(run) }
+        return reply
+    }
+    private func invoke(_ operation: String, _ input: [String: IndianaJSON]) async throws -> [String: IndianaJSON] {
+        let original=epoch
+        do { return try await accept(bridge.invoke(operation,input:input),epoch:original) }
+        catch {
+            if let failure=error as? IndianaClientError {
+                switch failure { case .identityChanged,.unauthenticated: current=nil;await presentation?.reset();presentation=nil;default:break }
+            }
+            throw error
+        }
+    }
+    public func open(_ input: [String: IndianaJSON]) async throws -> [String: IndianaJSON] {
+        try IndianaSchema.validate("processOpen",data:bytes(input));_ = try await invoke("open",input)
+        try await settlePending(); return try await invoke("get",[:])
+    }
+    public func syncIdentity() async throws -> [String: IndianaJSON] {
+        _ = try await invoke("syncIdentity",[:]);try await settlePending()
+        let result=try await invoke("get",[:]);_ = try await presentation?.get();return result
+    }
+    public func get(_ input: [String: IndianaJSON] = [:]) async throws -> [String: IndianaJSON] {
+        var input=input
+        if let id=input["settlementRequestId"] {
+            let saved=try await record()
+            for lane in ["pending","close"] where saved[lane]?.object?["command"]?.object?["requestId"]==id { input["settlementBindingId"]=saved[lane]?.object?["bindingId"] ?? .null }
+        }
+        return try await invoke("get",input)
+    }
+    public func command(_ command: [String: IndianaJSON]) async throws -> [String: IndianaJSON] {
+        try IndianaSchema.validate("processMutation",data:bytes(command))
+        guard let current else { throw IndianaFunnelError.invalidCommand }
+        let original=epoch
+        let envelope: [String: IndianaJSON] = ["command":.object(command),"bindingId":current["identity"]?.object?["binding"]?.object?["id"] ?? .null]
+        let lane=command["operation"] == .string("close") ? "close" : "pending"
+        var accepted=envelope
+        try await update { record in
+            var next=record
+            if let pending=record[lane]?.object {
+                guard pending["command"]==envelope["command"] else { throw IndianaFunnelError.commandPending };accepted=pending
+            } else { next[lane] = .object(envelope) }
+            return next
+        }
+        guard original==epoch else { throw IndianaFunnelError.identityChanged }
+        return try await invoke("command",accepted)
+    }
+    private func settlePending() async throws {
+        let saved=try await record()
+        for lane in ["pending","close"] {
+            guard let pending=saved[lane]?.object, let id=pending["command"]?.object?["requestId"] else { continue }
+            _ = try await get(["settlementRequestId":id,"settlementBindingId":pending["bindingId"] ?? .null])
+        }
+    }
+    /// Reuses the native renderer without a second command journal or a Customer-token installation.
+    public func presentationSession() throws -> IndianaFunnelSession {
+        if let presentation { return presentation }
+        guard let runToken else { throw IndianaFunnelError.invalidCommand }
+        let value=try IndianaFunnelSession(configuration:configuration,http:ProcessHTTP(process:self),runToken:runToken)
+        presentation=value;return value
+    }
+    public func detach() async throws {
+        epoch=UUID();current=nil;await presentation?.reset();presentation=nil;runToken=nil
+        try await bridge.detach()
+    }
+    fileprivate func rendered(_ command: [String: IndianaJSON]) async throws -> Data {
+        let operation=command["operation"]?.string ?? ""
+        var input=command;input.removeValue(forKey:"operation");input.removeValue(forKey:"customerToken")
+        var reply: [String: IndianaJSON]
+        if operation=="get" { reply=try await get(input) }
+        else if operation=="review" { reply=try await invoke("review",input) }
+        else { var mutation=command;mutation.removeValue(forKey:"customerToken");reply=try await self.command(mutation) }
+        reply.removeValue(forKey:"contract")
+        var run=reply["run"]!.object!;let identity=run.removeValue(forKey:"identity")!.object!
+        run["authenticated"] = .bool(identity["binding"] != .null)
+        if run["instruction"]?.object?["type"] == .string("authentication_required") { run["instruction"] = .null }
+        reply["run"] = .object(run)
+        if var settlement=reply["settlement"]?.object { settlement.removeValue(forKey:"accepted");reply["settlement"] = .object(settlement) }
+        return try bytes(reply)
+    }
+}
+private struct ProcessHTTP: IndianaHTTP {
+    let process: IndianaFunnelProcess
+    func send(path: String,method: String,authorization: String,body: Data?) async throws -> Data {
+        guard path=="funnels",method=="POST",let body else { throw IndianaFunnelError.invalidCommand }
+        return try await process.rendered(JSONDecoder().decode([String: IndianaJSON].self,from:body))
+    }
+}

package/native-sdk/ios/FunnelSession.swift

@@ -40,6 +40,7 @@ public actor IndianaFunnelSession {
     public private(set) var pendingPurchase: [String: IndianaJSON]?
     private var customerToken: String?; private var epoch = UUID(); private var pending: [String: IndianaJSON]?; private var sending = false; private var closingCommand: [String: IndianaJSON]?; private var closeRequested = false; private var uncertain = Set<String>(); private var settlements: [String: String] = [:]
     private var invalidated = false; private var invalidation: (@Sendable () -> Void)?; private var response: Data?
+    private var closingSending = false
     public private(set) var current: IndianaFunnelRun?
     public init(configuration: IndianaConfiguration, runToken: String, commandStorage: (any IndianaFunnelCommandStorage)? = nil) throws {
         guard runToken.range(of: "^gg_fr_[A-Za-z0-9_-]{43}$", options: .regularExpression) != nil else { throw IndianaFunnelError.invalidCommand }
@@ -59,7 +60,10 @@ public actor IndianaFunnelSession {
         let record = try await restoration!.value
         guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
         if restored { return }; restored = true
-        pending = record?.command; closingCommand = record?.closeCommand; pendingPurchase = record?.purchase; closeRequested = record?.closed == true || pending?["operation"] == .string("close")
+        let command = record?.command
+        pending = command?["operation"] == .string("close") ? nil : command
+        closingCommand = command?["operation"] == .string("close") ? command : record?.closeCommand
+        pendingPurchase = record?.purchase; closeRequested = record?.closed == true || closingCommand != nil
         for command in [pending, closingCommand].compactMap({ $0 }) { if let id = command["requestId"]?.string { uncertain.insert(id) } }
     }
     public func identify(customerToken: String) throws {
@@ -70,10 +74,11 @@ public actor IndianaFunnelSession {
     func hostConfiguration() -> IndianaConfiguration { configuration }
     func onInvalidation(_ callback: @escaping @Sendable () -> Void) { invalidation = callback;if invalidated { callback() } }
     func hostPendingCommand() -> IndianaJSON { (closingCommand ?? pending).map(IndianaJSON.object) ?? .null }
-    private func request(_ command: [String: IndianaJSON]) async throws -> IndianaFunnelRun {
+    private func request(_ command: [String: IndianaJSON], expectedEpoch: UUID? = nil) async throws -> IndianaFunnelRun {
         try await restoreCommands()
         guard !invalidated else { throw IndianaFunnelError.identityChanged }
         let original = epoch;var body = command;if let customerToken { body["customerToken"] = .string(customerToken) }
+        guard expectedEpoch == nil || expectedEpoch == original else { throw IndianaFunnelError.identityChanged }
         let encoder = JSONEncoder();encoder.outputFormatting = [.sortedKeys];let input = try encoder.encode(body)
         guard input.count <= 262144 else { throw IndianaFunnelError.invalidCommand };try IndianaSchema.validate("command", data: input)
         let bytes = try await http.send(path: "funnels", method: "POST", authorization: runToken, body: input)
@@ -133,38 +138,61 @@ public actor IndianaFunnelSession {
     }
     private func mutate(_ command: [String: IndianaJSON]) async throws -> IndianaFunnelRun {
         try await restoreCommands()
+        guard !invalidated else { throw IndianaFunnelError.identityChanged }
         let closing = command["operation"] == .string("close"), id = command["requestId"]?.string ?? ""
         if closeRequested && !closing { throw IndianaFunnelError.commandPending }
-        if sending && !closing { throw IndianaFunnelError.commandPending }
+        if closing ? closingSending : sending { throw IndianaFunnelError.commandPending }
         if closing {
+            if pending?["requestId"] == .string(id) { throw IndianaFunnelError.invalidCommand }
             closeRequested = true
             if let closingCommand, closingCommand != command { throw IndianaFunnelError.commandPending }
             closingCommand = command
+            closingSending = true
         } else {
             if let pending, pending != command { throw IndianaFunnelError.commandPending };pending = command
+            sending = true
         }
-        let wasUncertain = uncertain.contains(id);uncertain.insert(id);sending = true;let original = epoch
-        defer { sending = false }
+        let wasUncertain = uncertain.contains(id), original = epoch
+        defer { if closing { closingSending = false } else { sending = false } }
         do {
             if let journal { guard let current else { throw IndianaFunnelError.invalidCommand }; try await journal.retain(command, run: current) }
-            let run = try await request(command)
+            guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
+            uncertain.insert(id)
+            let run = try await request(command, expectedEpoch: original)
             let settled = settlements[id] == "settled"
             if original == epoch, run.pendingRequest?.requestId.uuidString.lowercased() != id,
                settled,
                (!closeRequested || closing || settled && !["running", "waiting"].contains(run.status)) {
                 try await journal?.settle(id)
+                guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
                 if pending == command { pending = nil };if closingCommand == command { closingCommand = nil };uncertain.remove(id)
             }
+            guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
             return run
         } catch {
-            if original == epoch, !wasUncertain, !closeRequested, let failure = error as? IndianaClientError, case .requestFailed(let status) = failure, status < 500, status != 401, status != 425 { try await journal?.settle(id); if pending == command { pending = nil };uncertain.remove(id) }
+            if original == epoch, !invalidated, !wasUncertain,
+               pending == command || closingCommand == command,
+               let failure = error as? IndianaClientError, case .requestFailed(let status) = failure,
+               status < 500, status != 401, status != 425 {
+                try await journal?.settle(id)
+                guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
+                if pending == command { pending = nil };if closingCommand == command { closingCommand = nil };uncertain.remove(id)
+            }
             throw error
         }
     }
     public func settle(requestId: UUID) async throws -> IndianaFunnelRun {
-        let id = requestId.uuidString.lowercased();settlements.removeValue(forKey: id);let run = try await request(["operation": .string("get"), "settlementRequestId": .string(id)])
+        try await restoreCommands()
+        let original = epoch, id = requestId.uuidString.lowercased();settlements.removeValue(forKey: id)
+        let run = try await request(["operation": .string("get"), "settlementRequestId": .string(id)], expectedEpoch: original)
         guard let state = settlements[id] else { throw IndianaFunnelError.invalidResponse }
-        if state == "settled" { try await journal?.settle(id); if pending?["requestId"] == .string(id) { pending = nil };if closingCommand?["requestId"] == .string(id) { closingCommand = nil };uncertain.remove(id) };return run
+        if state == "settled", run.pendingRequest?.requestId != requestId {
+            try await journal?.settle(id)
+            guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
+            if pending?["requestId"] == .string(id) { pending = nil };if closingCommand?["requestId"] == .string(id) { closingCommand = nil };uncertain.remove(id)
+        }
+        guard original == epoch, !invalidated else { throw IndianaFunnelError.identityChanged }
+        return run
     }
     private func base(_ operation: String, requestId: UUID) throws -> [String: IndianaJSON] {
         guard let current, !invalidated else { throw IndianaFunnelError.invalidCommand }

package/native-sdk/ios/HTTPTransport.swift

@@ -42,6 +42,7 @@ final class IndianaURLTransport: IndianaHTTP, Sendable {
         config.timeoutIntervalForRequest = configuration.timeout; config.timeoutIntervalForResource = configuration.timeout
         self.session = URLSession(configuration: config, delegate: NoRedirect(), delegateQueue: nil)
     }
+    deinit { session.invalidateAndCancel() }
     func send(path: String, method: String, authorization: String, body: Data?) async throws -> Data {
         guard !path.contains(".."), !path.contains("?"), !path.contains("#"), !path.hasPrefix("/") else { throw IndianaClientError.invalidConfiguration }
         var request = URLRequest(url: requestOrigin.appendingPathComponent("api/v1").appendingPathComponent(path))
@@ -54,6 +55,7 @@ final class IndianaURLTransport: IndianaHTTP, Sendable {
         request.setValue(IndianaSDK.version, forHTTPHeaderField: "X-Indiana-SDK-Version")
         do {
             let (bytes, response) = try await session.bytes(for: request)
+            defer { bytes.task.cancel() }
             guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
                 throw IndianaClientError.requestFailed((response as? HTTPURLResponse)?.statusCode ?? 0)
             }

package/native-sdk/ios/IndianaClient.swift

@@ -162,11 +162,9 @@ public actor IndianaClient {
     private var pushObservationID = UUID()
     public private(set) var pushSynchronizationError: IndianaClientError?
     private let nativeStore: any IndianaAppleStore
-    private let nativeStorage: any IndianaNativePendingStorage
     private let durableFunnels: Bool
     private var storeRestorePending: [String: (UUID, Data)] = [:]
     private var recoveringNative = false
-    private var nativeReceiptPending: [UUID: (UUID, Data)] = [:]
     private struct WeakFunnel { weak var value: IndianaFunnelSession? }
     private var funnels: [WeakFunnel] = []
     private struct WeakPaywall { weak var value: IndianaPaywallSession? }
@@ -177,8 +175,8 @@ public actor IndianaClient {
     private struct WeakFeature { weak var value: IndianaFeatureClient? }
     private var featuresClients: [WeakFeature] = []
     #endif
-    public init(configuration: IndianaConfiguration, sessionConfiguration: URLSessionConfiguration = .ephemeral) { self.configuration = configuration; self.http = IndianaSessionTransport(IndianaURLTransport(configuration: configuration, sessionConfiguration: sessionConfiguration), scope: configuration.scope); self.nativeStore = AppleStorefront(); self.nativeStorage = IndianaNativePendingKeychain(scope: configuration.scope); self.durableFunnels = true }
-    init(configuration: IndianaConfiguration, http: any IndianaHTTP, store: (any IndianaAppleStore)? = nil, nativeStorage: (any IndianaNativePendingStorage)? = nil, publicPaywallContent: (@Sendable (IndianaJSON) async throws -> IndianaJSON)? = nil, sessionNow: @escaping @Sendable () -> Date = { Date() }) { self.publicPaywallContent = publicPaywallContent; self.configuration = configuration; self.http = IndianaSessionTransport(http, scope: configuration.scope, now: sessionNow); self.nativeStore = store ?? AppleStorefront(); self.nativeStorage = nativeStorage ?? IndianaNativePendingKeychain(scope: configuration.scope); self.durableFunnels = false }
+    public init(configuration: IndianaConfiguration, sessionConfiguration: URLSessionConfiguration = .ephemeral) { self.configuration = configuration; self.http = IndianaSessionTransport(IndianaURLTransport(configuration: configuration, sessionConfiguration: sessionConfiguration), scope: configuration.scope); self.nativeStore = AppleStorefront(); self.durableFunnels = true }
+    init(configuration: IndianaConfiguration, http: any IndianaHTTP, store: (any IndianaAppleStore)? = nil, publicPaywallContent: (@Sendable (IndianaJSON) async throws -> IndianaJSON)? = nil, sessionNow: @escaping @Sendable () -> Date = { Date() }) { self.publicPaywallContent = publicPaywallContent; self.configuration = configuration; self.http = IndianaSessionTransport(http, scope: configuration.scope, now: sessionNow); self.nativeStore = store ?? AppleStorefront(); self.durableFunnels = false }
     public func identify(customerToken token: String) async throws {
         guard token.range(of: "^gg_ct_[A-Za-z0-9_-]{32,128}$", options: .regularExpression) != nil else { throw IndianaClientError.unauthenticated }
         try await installIdentity(token)
@@ -186,7 +184,7 @@ public actor IndianaClient {
     private func installIdentity(_ token: String, session: IndianaCustomerSession? = nil) async throws {
         analyticsTimer?.cancel(); analyticsTimer = nil; analyticsEvents = []
         if let pushIdentity { pushBindingSequence = try pushIdentity.reserve(); pushSynchronizationError = nil }
-        epoch = UUID(); pushObservationID = UUID(); customerToken = token; nativeReceiptPending = [:]; storeRestorePending = [:]
+        epoch = UUID(); pushObservationID = UUID(); customerToken = token; storeRestorePending = [:]
         let previous = takeViews()
         credentialRevision += 1; let revision = credentialRevision, original = epoch
         let invalidated: @Sendable () async -> Void = { [weak self] in await self?.invalidateSession(revision: revision) }
@@ -302,7 +300,7 @@ public actor IndianaClient {
         analyticsTimer?.cancel(); analyticsTimer = nil; analyticsEvents = []
         do { if let pushIdentity { _ = try pushIdentity.reserve(detach: true) }; pushSynchronizationError = nil }
         catch { pushSynchronizationError = .protectedStorageUnavailable }
-        epoch = UUID(); pushObservationID = UUID(); customerToken = nil; pushBindingSequence = 0; nativeReceiptPending = [:]; storeRestorePending = [:]
+        epoch = UUID(); pushObservationID = UUID(); customerToken = nil; pushBindingSequence = 0; storeRestorePending = [:]
         return takeViews()
     }
     private func closeViews(_ previous: CustomerViews) async {
@@ -326,60 +324,14 @@ public actor IndianaClient {
         schedulePush()
         await closeViews(previous)
     }
-    /// The relay runs on your backend and adds its API key. A Funnel run token is never used for order recovery.
+    /// StoreKit's current transactions are the recovery source: every SDK purchase carries its order binding as its app
+    /// account token and stays unfinished until the server confirms it, so `restorePurchases` and a retried
+    /// `purchaseSubscription` recover it. No local order journal exists; this compatibility entry relays nothing and
+    /// returns no orders.
+    @available(*, deprecated, message: "StoreKit's current transactions are the recovery source; call restorePurchases(synchronizeStore:).")
     public func recoverNativeOrders(using relay: @Sendable (Data) async throws -> Data, synchronizeStore: Bool = false) async throws -> [Data] {
-        guard let token = customerToken, configuration.scope.environment == .sandbox, !recoveringNative else { throw IndianaClientError.unauthenticated }
-        recoveringNative = true; defer { recoveringNative = false }; let original = epoch
-        let storage = nativeStorage
-        let records = try await storage.orders()
-        let scanned = synchronizeStore ? try await nativeStore.restore() : await nativeStore.scanUnfinished()
-        var responses: [Data] = []
-        for record in records {
-            let matching = scanned.filter { $0.productID == record.productId && $0.accountToken == record.accountToken }
-            let items: [ApplePurchaseEvidence?] = matching.isEmpty ? [nil] : matching.map { Optional($0) }
-            for item in items {
-                guard original == epoch else { throw IndianaClientError.identityChanged }
-                let command: (UUID, Data)
-                if let pending = nativeReceiptPending[record.orderId] { command = pending }
-                else {
-                    let requestId = UUID()
-                    var proof: IndianaJSON = .null
-                    if let item {
-                        guard item.signedTransaction.utf8.count <= 131072 else { throw IndianaClientError.invalidResponse }
-                        proof = .object(["provider":.string("apple"), "orderId":.string(record.orderId.uuidString.lowercased()), "receiptId":.string(record.receiptId.uuidString.lowercased()), "signedTransaction":.string(item.signedTransaction)])
-                    }
-                    let body: IndianaJSON = .object(["operation":.string("native_receipt"), "requestId":.string(requestId.uuidString.lowercased()), "customerToken":.string(token), "orderId":.string(record.orderId.uuidString.lowercased()), "receiptId":.string(record.receiptId.uuidString.lowercased()), "nativeEvidence":proof])
-                    command = (requestId, try JSONEncoder().encode(body)); nativeReceiptPending[record.orderId] = command
-                }
-                let credential = try await preparedCustomerToken()
-                guard original == epoch else { throw IndianaClientError.identityChanged }
-                var outgoing = try JSONSerialization.jsonObject(with: command.1) as! [String: Any]
-                outgoing["customerToken"] = credential
-                let payload = try JSONSerialization.data(withJSONObject: outgoing)
-                let bytes: Data
-                do { bytes = try await relay(payload) }
-                catch let error as IndianaClientError {
-                    guard original == epoch else { throw IndianaClientError.identityChanged }
-                    if case .requestFailed(let status) = error, status < 500, status != 425 {
-                        nativeReceiptPending.removeValue(forKey: record.orderId)
-                        if status == 403 || status == 404 { continue }
-                    }
-                    throw error
-                }
-                guard original == epoch else { throw IndianaClientError.identityChanged }
-                struct Reply: Decodable { let scope: IndianaScope; let requestId: UUID; let orderId: UUID; let receiptId: UUID; let orderStatus: String; let refunded: Bool; let nativeCompletion: IndianaNativeCompletion? }
-                guard bytes.count <= 262144, let reply = try? JSONDecoder().decode(Reply.self, from: bytes), reply.scope == configuration.scope, reply.requestId == command.0, reply.orderId == record.orderId, reply.receiptId == record.receiptId, ["created", "pending", "trialing", "paid", "cancelled", "failed"].contains(reply.orderStatus) else { throw IndianaClientError.invalidResponse }
-                if let completion = reply.nativeCompletion {
-                    guard completion.orderId == record.orderId, completion.receiptId == record.receiptId, (1...50).contains(completion.transactionIds.count), Set(completion.transactionIds).count == completion.transactionIds.count, completion.transactionIds.allSatisfy({ !$0.isEmpty && $0.count <= 255 }) else { throw IndianaClientError.invalidResponse }
-                    for transaction in scanned where transaction.productID == record.productId && transaction.accountToken == record.accountToken && completion.transactionIds.contains(transaction.transactionID) {
-                        try await nativeStore.finish(transactionID: transaction.transactionID, confirmedTransactionIDs: Set(completion.transactionIds))
-                    }
-                    if !completion.membership { try await storage.remove(record.orderId) }
-                }
-                nativeReceiptPending.removeValue(forKey: record.orderId); responses.append(bytes)
-            }
-        }
-        return responses
+        guard customerToken != nil else { throw IndianaClientError.unauthenticated }
+        return []
     }
     /// Restores store transactions after reinstall or a device change. No local order journal is required.
     public func restorePurchases(synchronizeStore: Bool = false) async throws -> [Data] {
@@ -395,10 +347,23 @@ public actor IndianaClient {
             guard original == epoch else { throw IndianaClientError.identityChanged }
             // Unbound historical or family-shared transactions are not automatically transferred to an app account.
             guard let intent = purchase.accountToken else { continue }
-            replies.append(try await submitStorePurchase(purchase, intent: intent, original: original))
+            if let reply = try await restoreOne(purchase, intent: intent, original: original) { replies.append(reply) }
         }
         return replies
     }
+    /// The App Store account can hold transactions bound to another Customer or scope. Their definite refusal (403/404)
+    /// skips that transaction; any other refusal or unknown result ends the restore.
+    private func restoreOne(_ purchase: ApplePurchaseEvidence, intent: UUID, original: UUID) async throws -> Data? {
+        do { return try await submitStorePurchase(purchase, intent: intent, original: original) }
+        catch let error as IndianaClientError {
+            guard original == epoch else { throw IndianaClientError.identityChanged }
+            guard case .requestFailed(let status) = error else { throw error }
+            // A definite refusal settles that request; a later attempt starts a new one.
+            if (400..<500).contains(status), status != 425 { storeRestorePending.removeValue(forKey: purchase.transactionID) }
+            guard status == 403 || status == 404 else { throw error }
+            return nil
+        }
+    }
     private func submitStorePurchase(_ purchase: ApplePurchaseEvidence, intent: UUID, original: UUID) async throws -> Data {
         guard purchase.signedTransaction.utf8.count <= 131072 else { throw IndianaClientError.invalidResponse }
         let command: (UUID, Data)