* other(samplecat): add a Checkpoints tab with 4 samples
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* other: delete CheckpointTester
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* other: point agents to SampleCat for integration examples
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* other(samplecat): use result.hasEntitlement in checkpoint callbacks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* other(ci): add a SampleCat smoke build with Tuist (#8163)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(checkpoints): ad presenter layer
Resolves checkpoint workflows whose only step is an ad step to a
registered AdPresenter, adapted to the CheckpointResult API: a shown or
rewarded ad passes with the latest customer info, a failed ad or a
missing presenter passes with no flow.
* refactor(checkpoints): fold the ad outcome into the checkpoint result
* refactor(checkpoints): fail the checkpoint when an ad could not be shown
* refactor: moved to file private and added explanation to null customerinfo
* fix(checkpoints): suppress the checkpoint when nothing was presented
* Attribute checkpoint offering purchases to the hit trace id
Put the hit's trace id on the matched offering's presented context and send it as presented_trace_id on receipts.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Require traceID in withCheckpointIdentifier
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Use the checkpoint trace id for the offering's workflow
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Carry the hit trace id on matchedOffering
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Require traceID in withPresentedCheckpointIdentifier and tighten trace id tests
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Create the matched offering and its trace id in one place
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Add trace_id to the checkpoint hit event
The id is created when the checkpoint is evaluated and handed to the workflow it
starts, so the hit, the workflow's step and paywall events and the receipt's
paywall trace_id all share it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Drop Android references from trace id comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Remove remaining Android references in workflow event comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: report what a checkpoint resolved to on the hit event
The hit only carried the identifier, so nothing downstream could tell a
checkpoint that presented a paywall from one that matched nothing. It now
carries checkpoint_type, result, and the workflow, offering and rule ids.
The hit moves to after resolution so it has an outcome to report. A resolution
that throws now reports nothing, which is the one case where registering the
identifier is lost.
Picks up cesar's #7563 while he is out. Outcome fields are optional so hits
stored by an older SDK version still decode off disk.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FAMocQ6tct3P2rexywxjLu
* refactor: require the checkpoint outcome and trim comments
Checkpoint hits have not shipped, so there are no stored events with the old
shape and checkpoint_type and result do not need to be optional. The three ids
stay optional because they only exist when the checkpoint resolved to them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FAMocQ6tct3P2rexywxjLu
* fix: date the checkpoint hit before resolving it
Resolution awaits rules, audiences, workflow data and offerings, so taking the
date afterwards reported resolution-completion time as the hit time. On a cold
start that drifts by a full network round trip.
Adds coverage for the resolution to event mapping, which nothing exercised:
present_ui with its workflow id, return_data with its offering id, and each
no-action reason.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FAMocQ6tct3P2rexywxjLu
* chore: register the new test file in RevenueCat.xcodeproj
The CI test plans point at container:RevenueCat.xcodeproj, which lists test
files explicitly, so without this the new tests never run on CI.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FAMocQ6tct3P2rexywxjLu
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Parse workflow experiment enrollment from the config item combo_key
The workflows topic serves each workflow item with a combo_key that
encodes the experiment variants the user was bucketed into
(experiment_id=variant_key pairs joined by ;, or default). Parse it
into WorkflowDataResult.enrolledVariants on every read path so steps
can report experiment exposure in a follow-up. Workflows without an
experiment keep enrolledVariants nil.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Tighten combo_key parsing after review
Drop the redundant default sentinel guard (no pair parses out of it
anyway), keep the moved helpers private, pin that = inside a variant
key is kept, and trim the doc comments.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Echo the step's experiment params on workflow step events
Khepri bakes experiment_id and experiment_variant into the steps of the
enrolled variant (khepri #24946, one experiment per screen) and enrolls
the subscriber on the first step_started that echoes them. Read both
from the step's param_values and put them on every step event.
Drops the combo_key parsing from the previous commits: enrollment must
not be derived from what the config endpoint served, only from exposure.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Trim comments to the ones that carry information
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Reword the experiment param comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Plainer wording on the experiment param comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Address review: plainer param docs and wire coverage for close
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Delete isLastVariantStep from the SDK
Khepri computes it server side and never puts it in the workflow blob,
so the SDK has nothing to read or send.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Report the workflow blob ref on step events
Khepri needs the blob the client rendered to validate the experiment
params it reports, instead of trusting them. Carry the config item's
blob_ref from the workflows topic through to every step event.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Group the experiment fields and name the ref workflowBlobRef
Per the thread: the blob ref only means something as proof of an
experiment claim, so it travels with the experiment instead of riding
on every workflow event. SDK-level naming is workflowBlobRef so it
does not read as a bare config-layer concept; the wire keys stay
experiment_id, experiment_variant and blob_ref.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Drop comments that restate the code
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Require the workflow blob ref alongside the experiment params
A workflow can only be read through a blob, so a rendered step that has
experiment params always has a ref. Making it required means khepri
never receives a claim it cannot validate.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Carry the blob ref through the checkpoint presentation path
Checkpoint workflows build their context through WorkflowPreview, which
left the ref nil, so a checkpoint-presented experiment step reported
nothing once the ref became required. Thread it from the resolved
workflow. Injected dashboard previews still pass none.
ResolvedCheckpointWorkflow moves to its own file, unchanged, to keep the
resolver under the file length limit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Register ResolvedCheckpointWorkflow.swift in RevenueCat.xcodeproj
The legacy project enumerates sources by hand, so a file added outside
Xcode is invisible to it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Name the request property workflowBlobRef
Matches the Android rename; wire name stays blob_ref.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix: fail rule resolution when customer changes
* refactor: use app user terminology
* fix: defer stale audience evaluation errors
* docs: clarify audience evaluation failure
* test(Checkpoints): provide app user ID to rule evaluator
* Deserialize audience rules for rules engine evaluation
The rules engine takes a predicate as a string, so decoding the audience
as an opaque blob would only mean serializing it back before every
evaluation. Decode `id` and keep `rules` as the JSON string the engine
takes.
Keys are sorted on the way out because Swift dictionaries have no order
of their own, and an unstable predicate string would be a moving target
for anything that caches or compares it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Evaluate checkpoint audiences
Checkpoint rules each target an audience, but resolution took the first
served rule regardless. Resolve each rule's audience through the
`audiences` topic and evaluate its predicate, so the first rule whose
audience the customer matches wins.
Predicates resolve one rule at a time, so a rule after the match never
pays for a lookup. An audience the SDK couldn't read leaves the outcome
unknown, so it reports `configurationUnavailable` rather than `noMatch`,
and can't let a lower-priority rule win instead.
Also starts honoring `CheckpointParams.customVariables`, which the
resolver dropped until now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Cover a malformed audience falling through to a later rule
Ports the one case purchases-android#3971 tests that iOS did not: a
predicate the engine can't run is an evaluation failure, not a lookup
failure, so a lower-priority rule can still win on its own merits.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Cover served audience payload shapes and the terminal-offering gate
Decodes through the real Audience decoder so the predicate under test is
what a served payload produces: empty rules match everyone (the engine
only dispatches single-key objects, and every object is truthy), the
backend's always-false sentinel resolves to a clean non-match, and a
predicate on a variable no provider supplies is false rather than an
error.
Also covers that the audience gate runs before the workflow body picks
between presenting and handing back an offering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Read audiences from the topic item instead of a blob
The audiences topic serves each audience inline in its config item, with
no blob_ref, so the blob read found nothing and every lookup returned
nil. With audience evaluation in place that surfaced as
configurationUnavailable for every checkpoint, so nothing presented.
Read the item's own content first and keep the blob read as a fallback
for any project still served the earlier shape.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Pin that a negated unsupplied variable matches everyone
An unresolvable path does not fail closed. Under negation it inverts:
null == "NL" is false, so ! makes it true and the audience matches every
customer, including the ones it was written to exclude.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Read audiences from item metadata only, matching Android
khepri publishes each audience as item metadata with blob_contents=None
and clear_blob=True, so the blob path is deliberately dead rather than
transitional. Drop the fallback and log the raw metadata before decoding,
matching purchases-android#3971.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Log audience metadata as JSON instead of parsed values
The interpolation happened at the call site, so the dictionary was
stringified even with debug logging off, and it printed AnyDecodable
case names rather than anything a human wants to read. Reuse the JSON
already built for decoding.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UND779kHH6TRc2662wzaj1
* Check config staleness before resolving the matched rule
Audiences are read from their own topic at lookup time, so they are not
covered by the rule snapshot's generation. A refresh landing mid-walk
meant the match was built from config that no longer existed, and the
existing check after resolve() could only discard the result: the
workflow fetch, the offerings load and the asset prewarm had already
happened.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VrDQrA37Fr5XZvpT1KvD8D
* Stop the rule walk when the task is cancelled
Neither the audience lookup nor RulesEngine.evaluate throws on
cancellation, so a cancelled resolution kept decoding audiences and
evaluating predicates for every remaining rule.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VrDQrA37Fr5XZvpT1KvD8D
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(checkpoints): Support headless offering checkpoints
Port of purchases-android #3951. When a matched checkpoint rule's workflow
is a single terminal `offering` step, resolve it to that offering and hand
it to the app instead of presenting anything.
The workflow body is now read before the offering mapping, since its shape
decides what else the rule needs. An unservable rule still resolves to
`configurationUnavailable` rather than falling through to a later rule.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FPNip3cub65pNgGuNbU8pf
* refactor(checkpoints): Realign headless offerings with android 1c579c7
Follows purchases-android#3951 after review there settled its shape:
- rename the resolution cases to matchedWorkflow / matchedOffering
- route on the initial step's type instead of "any offering step", and
reject a UI workflow that contains one
- drop the screen / trigger / trigger-action guards, an offering step
renders nothing so anything else it carries is ignored
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FPNip3cub65pNgGuNbU8pf
* fix(checkpoints): Don't prewarm assets for headless offering checkpoints
Prewarming takes its fonts from ui_config rather than from the workflow's
screens, so a screenless offering workflow was still downloading every
downloadable app font on a path that renders nothing. Splits the
non-prewarming read out of getWorkflow and prewarms only on the branch
that goes on to present, matching purchases-android.
Also folds the duplicated offerings lookup into one helper, flattens the
step-type branching, and reuses String.isNotEmpty (which trims newlines
too, unlike the hand-rolled check it replaces).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FPNip3cub65pNgGuNbU8pf
* test(checkpoints): Skip prewarming assertions below iOS 15
scheduleAssetPrewarming is behind an availability guard, so on the older
OS versions CI runs the positive assertion would fail and the negative
one would pass for the wrong reason. Matches the existing skip in
WorkflowManagerTests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FPNip3cub65pNgGuNbU8pf
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
