@burnt-labs/expo-satya-attest 0.2.1 → 0.2.4

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.2.2 - 2026-06-11
+
+- Fixed provider WebView login flows that could continuously refresh while the user was still on a login or SSO host.
+- Added a provider login-ready gate for endpoints that return an empty 200 response before authentication, so native replay waits for authenticated content.
+- Added optional verifier bearer-token support for provider policy refresh and backend artifact verification.
+- Updated Garmin profile capture to use the authenticated proxy endpoint and ship without local debug logging.

package/PUBLISHING.md

@@ -59,7 +59,7 @@ Build them from the module directory:
 ```bash
 cd platform_sdks/expo-satya-attest
 npm run build:native:android
-npm run build:native:ios
+SATYA_IOS_INCLUDE_SIMULATOR=1 npm run build:native:ios
 ```
 
 iOS artifacts can only be built on macOS with Xcode command line tools. Android artifacts
@@ -72,10 +72,9 @@ diagnostic unstripped iOS build:
 SATYA_IOS_STRIP=0 npm run build:native:ios
 ```
 
-By default, the iOS release build includes only the physical-device `arm64` slice. That
-is intentional: the real App Attest flow does not work on the iOS simulator, and shipping
-simulator slices makes the npm package much larger without helping the production claim
-path.
+Publishing builds include the physical-device `arm64` slice plus simulator slices so
+Expo development clients can install the SDK in simulator fallback flows. The real App
+Attest path still only works on physical devices.
 
 ## Release Checks
 
@@ -100,6 +99,7 @@ npm run clean
 npm run build
 npm run lint
 npm run test:providers
+npm run test:publishing-workflows
 npm run check:example
 npm run check:native-artifacts
 npm run check:pack
@@ -113,6 +113,7 @@ What each check covers:
 | `clean` + `build` | Rebuilds TypeScript output in `build/`. |
 | `lint` | Runs ESLint over `src/`. |
 | `test:providers` | Validates provider ids, template hashes, parser hashes, request match rules, HTTPS proof URLs, SNI, and SPKI pins. |
+| `test:publishing-workflows` | Confirms publish workflows build iOS artifacts with simulator slices and matching Rust targets. |
 | `check:example` | Type-checks the Expo example when its dependencies are installed. |
 | `check:native-artifacts` | Fails if Android `.so`, generated Kotlin, iOS XCFramework, or generated Swift glue are missing. |
 | `check:pack` | Runs `npm pack --dry-run --json` and verifies the actual tarball contents. |
@@ -267,7 +268,7 @@ GitHub release tarball smoke test:
 
 ```bash
 cd /private/tmp/SatyaSmoke
-npm install https://github.com/<owner>/<repo>/releases/download/expo-satya-attest-v0.2.1/burnt-labs-expo-satya-attest-0.2.1.tgz
+npm install https://github.com/<owner>/<repo>/releases/download/expo-satya-attest-v0.2.2/burnt-labs-expo-satya-attest-0.2.2.tgz
 npx expo install react-native-webview
 ```
 
@@ -275,7 +276,7 @@ For a raw Git install, publish the SDK from a dedicated repo or a subtree/split
 where the SDK package is at the Git root:
 
 ```bash
-npm install github:<owner>/<sdk-repo>#v0.2.1
+npm install github:<owner>/<sdk-repo>#v0.2.2
 ```
 
 Do not document a normal monorepo Git URL as plug-and-play unless the Git ref has
@@ -294,8 +295,8 @@ Keep watching:
 - `npm run check:pack` for npm tarball and unpacked package size.
 - Whether every release includes only the ABIs you actually support.
 
-Current default iOS output includes only device `arm64`. If you need simulator artifacts
-for local fallback/debug work, opt in explicitly:
+Current local iOS output includes only device `arm64` unless you opt in explicitly.
+Publish workflows and release builds should use:
 
 ```bash
 SATYA_IOS_INCLUDE_SIMULATOR=1 npm run build:native:ios
@@ -307,8 +308,8 @@ For Apple-Silicon-simulator-only fallback builds:
 SATYA_IOS_SIMULATOR_TARGETS="aarch64-apple-ios-sim" npm run build:native:ios
 ```
 
-Do not publish simulator slices unless you intentionally support a simulator fallback
-experience. They are not useful for real App Attest verification.
+Simulator slices are only for simulator fallback and development-client installability;
+they are not useful for real App Attest verification.
 
 If the tarball becomes too large for npm or painful for app installs, the next design
 step is a binary-release model:

package/README.md

@@ -68,10 +68,10 @@ npm run build:native:ios
 npm run build:native:android
 ```
 
-`build:native:ios` strips local/debug symbols from the XCFramework and publishes a
-physical-device `arm64` iOS slice by default because the real App Attest flow does not
-work on simulator. See [`PUBLISHING.md`](./PUBLISHING.md) for optional simulator fallback
-builds and other binary-size knobs.
+`build:native:ios` strips local/debug symbols from the XCFramework. Local builds include
+the physical-device `arm64` iOS slice by default; publishing builds set
+`SATYA_IOS_INCLUDE_SIMULATOR=1` so simulator fallback slices ship too. See
+[`PUBLISHING.md`](./PUBLISHING.md) for release and binary-size knobs.
 
 Build TypeScript after editing `src/*.ts` or `src/*.tsx`:
 
@@ -196,7 +196,7 @@ is a release tarball produced by `npm pack`, because it contains the same files
 would publish:
 
 ```bash
-npm install https://github.com/<owner>/<repo>/releases/download/expo-satya-attest-v0.2.1/burnt-labs-expo-satya-attest-0.2.1.tgz
+npm install https://github.com/<owner>/<repo>/releases/download/expo-satya-attest-v0.2.2/burnt-labs-expo-satya-attest-0.2.2.tgz
 npx expo install react-native-webview
 ```
 
@@ -204,8 +204,8 @@ Installing from a Git ref also works when that ref has the SDK package at the re
 root, such as a dedicated SDK repo or a subtree/split branch:
 
 ```bash
-npm install github:<owner>/<sdk-repo>#v0.2.1
-npm install git+https://github.com/<owner>/<sdk-repo>.git#v0.2.1
+npm install github:<owner>/<sdk-repo>#v0.2.2
+npm install git+https://github.com/<owner>/<sdk-repo>.git#v0.2.2
 npx expo install react-native-webview
 ```
 

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.satyaattest'
-version = '0.2.1'
+version = '0.2.4'
 
 android {
   namespace "expo.modules.satyaattest"
   defaultConfig {
     versionCode 1
-    versionName "0.2.1"
+    versionName "0.2.4"
     // StrongBox key attestation needs API 28+; basic Keystore attestation API 24+.
     minSdkVersion 24
   }

package/build/SatyaAttest.types.d.ts

@@ -7,6 +7,11 @@ export interface SatyaTransportConfig {
     notaryUrl: string;
     trustedNotaryKeys?: string[];
     enableLogging?: boolean;
+    /**
+     * Optional bearer token for verifier HTTP calls such as provider-policy refresh and
+     * backend artifact verification. This token is not sent to provider replay requests.
+     */
+    verifierBearerToken?: string;
     /**
      * Google Cloud project NUMBER (not the project id) for Play Integrity classic
      * requests on Android. When > 0 the native module requests a real Play Integrity

package/build/SatyaAttest.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttest.types.d.ts","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,UAAU,GACV,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB;IAAE,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GACnC,8BAA8B,CAAC;AAEnC,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC;;;;WAIG;QACH,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACvC;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC/C,CAAC;IACF,SAAS,CAAC,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;QACvD,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,gBAAgB,EAAE,KAAK,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6CAA6C;AAC7C,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"SatyaAttest.types.d.ts","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,UAAU,GACV,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB;IAAE,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GACnC,8BAA8B,CAAC;AAEnC,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC;;;;WAIG;QACH,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACvC;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC/C,CAAC;IACF,SAAS,CAAC,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;QACvD,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,gBAAgB,EAAE,KAAK,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6CAA6C;AAC7C,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}

package/build/SatyaAttest.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttest.types.js","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,uEAAuE;AAkVvE,6CAA6C;AAC7C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF","sourcesContent":["// Public types for expo-satya-attest. These mirror the SATYA-W artifact contract\n// and the Flutter plugin's client API so the two stay interchangeable.\n\n// The mock and webview-observed modes were removed as insecure: mock produces a\n// canned value with no real connection, and webview-observed signs an app-asserted\n// value the page/JS can tamper with. Only the certificate-pinned native replay tier\n// remains.\n\n/** Artifact mode as it appears in the JSON (`mode` / `statement.mode`). */\nexport type SatyaArtifactMode = 'native-pinned-observed';\n\n/** Lifecycle phases emitted as scripted progress by {@link SatyaMobileClient}. */\nexport type SatyaPhase =\n  | 'init'\n  | 'witnessEnrollment'\n  | 'notaryChallenge'\n  | 'witnessTlsSetup'\n  | 'tlsHandshake'\n  | 'recordExchange'\n  | 'selectiveReveal'\n  | 'witnessFinalize'\n  | 'notaryFinalize'\n  | 'verified'\n  | 'failed';\n\n/** Transport/runtime config passed to the client (serialized to `configJson`). */\nexport interface SatyaTransportConfig {\n  notaryUrl: string;\n  trustedNotaryKeys?: string[];\n  enableLogging?: boolean;\n  /**\n   * Google Cloud project NUMBER (not the project id) for Play Integrity classic\n   * requests on Android. When > 0 the native module requests a real Play Integrity\n   * token bound to the witness key; 0 (the default) keeps the honest dev fallback\n   * (no token → the verifier fails closed under a pass-2 policy). Ignored on iOS.\n   */\n  cloudProjectNumber?: number;\n}\n\n/** A single scripted progress event. */\nexport interface SatyaProgress {\n  phase: SatyaPhase;\n  message: string;\n  /** 0..1 */\n  percent: number;\n}\n\n/** A selectable provider from the catalog. */\nexport interface SatyaProviderEndpointRef {\n  id: string;\n  method: string;\n  url: string;\n  responseType?: string;\n}\n\nexport interface SatyaProviderRef {\n  label: string;\n  description: string;\n  providerId: string;\n  iconUrl?: string;\n  endpoints?: SatyaProviderEndpointRef[];\n}\n\nexport interface SatyaProviderRegistry {\n  schemaVersion?: string;\n  providers: SatyaProviderTemplate[];\n}\n\nexport interface SatyaProviderRegistryUrlSource {\n  /**\n   * HTTPS URL returning a JSON object with `{ schemaVersion, providers }`.\n   * `http://` is rejected unless `allowInsecureHttp` is explicitly set for local/dev use.\n   */\n  url: string;\n  /**\n   * Optional request headers for private registries. Prefer bearer tokens over credentials\n   * in the URL; registry URLs with username/password are rejected by the SDK.\n   */\n  headers?: Record<string, string>;\n  /** Request timeout in milliseconds. Defaults to 15000. */\n  timeoutMs?: number;\n  /** Maximum response body size in bytes. Defaults to 524288. */\n  maxBytes?: number;\n  /**\n   * Allows `http://` registry URLs. Keep this false outside local development; provider\n   * registry contents decide which hosts and templates the SDK will replay.\n   */\n  allowInsecureHttp?: boolean;\n}\n\nexport type SatyaProviderRegistrySource =\n  | SatyaProviderRegistry\n  | { registry: SatyaProviderRegistry }\n  | SatyaProviderRegistryUrlSource;\n\nexport type SatyaProviderInjection = string | string[];\n\n/**\n * A single response-body reveal that the native replay extracts into a disclosed claim.\n *\n * - `json`: read the value at `path` (a `$.a.b[0].c` JSON path) from a JSON body.\n * - `regex`: match `pattern` against the raw response body (HTML, text, or JSON) and\n *   disclose capture `group` (defaults to 1; may be a numbered index or a named group).\n * - `jsonRegex`: read the string value at `path` from a JSON body, then match `pattern`\n *   against it and disclose capture `group`.\n *\n * `regex` and `jsonRegex` require an explicit `alias`.\n */\nexport interface ResponseRevealRule {\n  alias: string;\n  type: 'json' | 'regex' | 'jsonRegex';\n  path?: string;\n  pattern?: string;\n  group?: number | string;\n}\n\nexport interface SatyaProviderLogin {\n  url: string;\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderEndpoint {\n  id: string;\n  url: string;\n  method: string;\n  headers: string[];\n  responseType: string;\n  requestMatchRules: Record<string, unknown>[];\n  revealRules: Record<string, unknown>[];\n  /**\n   * When true, the SDK actively fires this endpoint's request from inside the managed\n   * WebView (via an injected `fetch`) once the user is logged in, instead of waiting for\n   * the page to make the call. Capture is gated on a 2xx response, so it never triggers\n   * the native replay before login. Use for cookie-authenticated APIs that no page calls\n   * on its own (e.g. Reddit/Spotify/Roblox profile APIs).\n   */\n  triggerFromInjection?: boolean;\n  /**\n   * Extra request headers for the injected active fetch (only used with\n   * `triggerFromInjection`). Values may be literals or `{{cookie:NAME}}` templates resolved\n   * from `document.cookie` at fire time (for non-httpOnly CSRF/app-id headers). Header\n   * names are automatically added to the request-header allowlist for native replay.\n   */\n  injectionHeaders?: Record<string, string>;\n  /** Request body for the injected active fetch (POST/PUT/PATCH endpoints). */\n  requestBody?: string;\n  /**\n   * HTTPS page on the proof origin to navigate to when the active fetch is stuck on a\n   * sibling subdomain (e.g. after login Spotify lands on `open.spotify.com` but the API is\n   * on `www.spotify.com`). Prefer a stable signed-in page that itself loads the proof API.\n   * Defaults to the proof origin root (`https://<host>/`) when omitted.\n   */\n  injectionLandingUrl?: string;\n  /** Poll interval in ms for the active fetch (default 2000, bounded 500..15000). */\n  injectionPollMs?: number;\n  /** Max active-fetch attempts before giving up (default 60, bounded 1..300). */\n  injectionMaxAttempts?: number;\n  /**\n   * Replay the URL the WebView actually fetched, instead of the fixed template `url`. Use for\n   * endpoints whose path has a dynamic segment (e.g. a user id, like Garmin's\n   * `/userprofile-service/socialProfile/{userId}`) so native replay hits the real per-user URL.\n   * The captured URL is still constrained to the pinned host and the endpoint's match rules.\n   */\n  replayCapturedUrl?: boolean;\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderTemplate {\n  schemaVersion: string;\n  providerId: string;\n  name: string;\n  iconUrl?: string;\n  login: SatyaProviderLogin;\n  auth?: Record<string, unknown>;\n  endpoints: SatyaProviderEndpoint[];\n  selectedEndpointId?: string;\n  /** SDK-normalized compatibility fields used by native replay. */\n  label?: string;\n  description?: string;\n  displayName?: string;\n  version?: string;\n  target?: {\n    scheme: 'https';\n    host: string;\n    port: number;\n  };\n  webLogin?: {\n    startUrl: string;\n    callbackUrl?: string;\n    oauthHosts?: string[];\n  };\n  userAgent?: {\n    ios?: string | null;\n    android?: string | null;\n  } | null;\n  /**\n   * Provider-owned JavaScript to run inside the managed WebView on every page,\n   * alongside the SDK request interceptor. Provider registries are trusted policy:\n   * do not load this field from an untrusted source.\n   */\n  injection?: SatyaProviderInjection | null;\n  proofTarget?: {\n    method: string;\n    url: string;\n    requestMatchRules: Record<string, unknown>[];\n    revealRules: Record<string, unknown>[];\n    [key: string]: unknown;\n  };\n  privacyPolicy?: {\n    allowedRequestHeaders: string[];\n    /**\n     * JSON paths the proof may read from the response body. Subset of\n     * {@link ResponseRevealRule}s whose type is `json` or `jsonRegex`. Kept for\n     * backward compatibility; native extraction prefers `allowedResponseReveals`.\n     */\n    allowedResponseBodyJsonPaths: string[];\n    /**\n     * Structured response reveals the native replay extracts into disclosed claims.\n     * Supports JSON paths plus regex (over the raw HTML/text/JSON body) and jsonRegex\n     * (a JSON-path-selected value run through a regex).\n     */\n    allowedResponseReveals?: ResponseRevealRule[];\n  };\n  tlsPolicy?: {\n    requireTls13: boolean;\n    allowZeroRtt: boolean;\n    allowResumption: boolean;\n    allowKeyUpdate: boolean;\n    preferredCipher: string;\n    maxSentBytes: number;\n    maxRecvBytes: number;\n  };\n  tlsIdentityPolicy: {\n    expectedSni: string;\n    allowedAlpn?: string[];\n    spkiSha256Hex?: string | null;\n    spkiSha256B64Pins?: string[];\n    tlsTrustStorePolicy?: 'web-pki-os-roots-no-user-roots';\n    userRootsAllowed?: false;\n    redirectPolicyId?: string;\n  };\n  templateGovernance: {\n    templateHash: string;\n    parserHash: string;\n    fixtureSetHash?: string;\n    governancePolicyVersion?: string;\n    providerActivationState?: string;\n  };\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderPolicy {\n  providerId: string;\n  host: string;\n  templateHash: string;\n  parserHash: string;\n  providerActivationState: string;\n  spkiSha256B64Pins: string[];\n}\n\nexport interface CapturedProviderRequest {\n  url: string;\n  method: string;\n  headers: Record<string, string>;\n  body?: string | null;\n}\n\nexport interface CapturedProviderResponse {\n  url: string;\n  status: number;\n  headers: Record<string, string>;\n  body?: string | null;\n}\n\nexport interface NativeReplayTlsEvidence {\n  serverCertChainSha256Hex: string;\n  sni: string;\n  alpn: string;\n  tlsVersion: string;\n  tlsTrustStorePolicy: 'web-pki-os-roots-no-user-roots';\n  userRootsAllowed: false;\n  matchedSpkiSha256B64?: string | null;\n  expectedSpkiPinsB64: string[];\n}\n\nexport interface NativeReplayClaim {\n  name: string;\n  sourcePath: string;\n  value: unknown;\n}\n\nexport interface NativeReplayObservation {\n  providerId: string;\n  templateHash: string;\n  host: string;\n  method: string;\n  pathAndQuery: string;\n  statusCode: number;\n  finalUrl: string;\n  contentType?: string | null;\n  contentEncoding?: string | null;\n  responseSha256Hex: string;\n  claims: NativeReplayClaim[];\n  tlsEvidence: NativeReplayTlsEvidence;\n}\n\n/** Structured verifier outcome returned by the Rust core. */\nexport interface VerifyResult {\n  ok: boolean;\n  attestationId: string;\n  mode: string;\n  platformTier: string;\n  /** `dev-local` for the mock tier, `dev-device` for attested/simulator tiers. */\n  policy: string;\n  disclosedUsername?: string | null;\n  error?: string | null;\n}\n\n/**\n * The decoded SATYA-W artifact. Only the commonly-read fields are typed; the rest\n * of the (camelCase) graph is preserved under the index signature.\n */\nexport interface SatyaArtifact {\n  schemaVersion: string;\n  attestationId: string;\n  createdAtUtc: string;\n  mode: SatyaArtifactMode;\n  statement: Record<string, unknown>;\n  semanticStatement: Record<string, unknown>;\n  /** Legacy/full artifact disclosure. Compact native replay artifacts use disclosedClaims instead. */\n  disclosure?: Record<string, unknown>;\n  witnessCommitment: Record<string, unknown>;\n  witnessSignature: Record<string, unknown>;\n  notarySignature: Record<string, unknown>;\n  /** Legacy operational metrics. New proof artifacts omit this field. */\n  telemetry?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/** Error thrown by the high-level client. */\nexport class SatyaError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SatyaError';\n  }\n}\n"]}
+{"version":3,"file":"SatyaAttest.types.js","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,uEAAuE;AAuVvE,6CAA6C;AAC7C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF","sourcesContent":["// Public types for expo-satya-attest. These mirror the SATYA-W artifact contract\n// and the Flutter plugin's client API so the two stay interchangeable.\n\n// The mock and webview-observed modes were removed as insecure: mock produces a\n// canned value with no real connection, and webview-observed signs an app-asserted\n// value the page/JS can tamper with. Only the certificate-pinned native replay tier\n// remains.\n\n/** Artifact mode as it appears in the JSON (`mode` / `statement.mode`). */\nexport type SatyaArtifactMode = 'native-pinned-observed';\n\n/** Lifecycle phases emitted as scripted progress by {@link SatyaMobileClient}. */\nexport type SatyaPhase =\n  | 'init'\n  | 'witnessEnrollment'\n  | 'notaryChallenge'\n  | 'witnessTlsSetup'\n  | 'tlsHandshake'\n  | 'recordExchange'\n  | 'selectiveReveal'\n  | 'witnessFinalize'\n  | 'notaryFinalize'\n  | 'verified'\n  | 'failed';\n\n/** Transport/runtime config passed to the client (serialized to `configJson`). */\nexport interface SatyaTransportConfig {\n  notaryUrl: string;\n  trustedNotaryKeys?: string[];\n  enableLogging?: boolean;\n  /**\n   * Optional bearer token for verifier HTTP calls such as provider-policy refresh and\n   * backend artifact verification. This token is not sent to provider replay requests.\n   */\n  verifierBearerToken?: string;\n  /**\n   * Google Cloud project NUMBER (not the project id) for Play Integrity classic\n   * requests on Android. When > 0 the native module requests a real Play Integrity\n   * token bound to the witness key; 0 (the default) keeps the honest dev fallback\n   * (no token → the verifier fails closed under a pass-2 policy). Ignored on iOS.\n   */\n  cloudProjectNumber?: number;\n}\n\n/** A single scripted progress event. */\nexport interface SatyaProgress {\n  phase: SatyaPhase;\n  message: string;\n  /** 0..1 */\n  percent: number;\n}\n\n/** A selectable provider from the catalog. */\nexport interface SatyaProviderEndpointRef {\n  id: string;\n  method: string;\n  url: string;\n  responseType?: string;\n}\n\nexport interface SatyaProviderRef {\n  label: string;\n  description: string;\n  providerId: string;\n  iconUrl?: string;\n  endpoints?: SatyaProviderEndpointRef[];\n}\n\nexport interface SatyaProviderRegistry {\n  schemaVersion?: string;\n  providers: SatyaProviderTemplate[];\n}\n\nexport interface SatyaProviderRegistryUrlSource {\n  /**\n   * HTTPS URL returning a JSON object with `{ schemaVersion, providers }`.\n   * `http://` is rejected unless `allowInsecureHttp` is explicitly set for local/dev use.\n   */\n  url: string;\n  /**\n   * Optional request headers for private registries. Prefer bearer tokens over credentials\n   * in the URL; registry URLs with username/password are rejected by the SDK.\n   */\n  headers?: Record<string, string>;\n  /** Request timeout in milliseconds. Defaults to 15000. */\n  timeoutMs?: number;\n  /** Maximum response body size in bytes. Defaults to 524288. */\n  maxBytes?: number;\n  /**\n   * Allows `http://` registry URLs. Keep this false outside local development; provider\n   * registry contents decide which hosts and templates the SDK will replay.\n   */\n  allowInsecureHttp?: boolean;\n}\n\nexport type SatyaProviderRegistrySource =\n  | SatyaProviderRegistry\n  | { registry: SatyaProviderRegistry }\n  | SatyaProviderRegistryUrlSource;\n\nexport type SatyaProviderInjection = string | string[];\n\n/**\n * A single response-body reveal that the native replay extracts into a disclosed claim.\n *\n * - `json`: read the value at `path` (a `$.a.b[0].c` JSON path) from a JSON body.\n * - `regex`: match `pattern` against the raw response body (HTML, text, or JSON) and\n *   disclose capture `group` (defaults to 1; may be a numbered index or a named group).\n * - `jsonRegex`: read the string value at `path` from a JSON body, then match `pattern`\n *   against it and disclose capture `group`.\n *\n * `regex` and `jsonRegex` require an explicit `alias`.\n */\nexport interface ResponseRevealRule {\n  alias: string;\n  type: 'json' | 'regex' | 'jsonRegex';\n  path?: string;\n  pattern?: string;\n  group?: number | string;\n}\n\nexport interface SatyaProviderLogin {\n  url: string;\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderEndpoint {\n  id: string;\n  url: string;\n  method: string;\n  headers: string[];\n  responseType: string;\n  requestMatchRules: Record<string, unknown>[];\n  revealRules: Record<string, unknown>[];\n  /**\n   * When true, the SDK actively fires this endpoint's request from inside the managed\n   * WebView (via an injected `fetch`) once the user is logged in, instead of waiting for\n   * the page to make the call. Capture is gated on a 2xx response, so it never triggers\n   * the native replay before login. Use for cookie-authenticated APIs that no page calls\n   * on its own (e.g. Reddit/Spotify/Roblox profile APIs).\n   */\n  triggerFromInjection?: boolean;\n  /**\n   * Extra request headers for the injected active fetch (only used with\n   * `triggerFromInjection`). Values may be literals or `{{cookie:NAME}}` templates resolved\n   * from `document.cookie` at fire time (for non-httpOnly CSRF/app-id headers). Header\n   * names are automatically added to the request-header allowlist for native replay.\n   */\n  injectionHeaders?: Record<string, string>;\n  /** Request body for the injected active fetch (POST/PUT/PATCH endpoints). */\n  requestBody?: string;\n  /**\n   * HTTPS page on the proof origin to navigate to when the active fetch is stuck on a\n   * sibling subdomain (e.g. after login Spotify lands on `open.spotify.com` but the API is\n   * on `www.spotify.com`). Prefer a stable signed-in page that itself loads the proof API.\n   * Defaults to the proof origin root (`https://<host>/`) when omitted.\n   */\n  injectionLandingUrl?: string;\n  /** Poll interval in ms for the active fetch (default 2000, bounded 500..15000). */\n  injectionPollMs?: number;\n  /** Max active-fetch attempts before giving up (default 60, bounded 1..300). */\n  injectionMaxAttempts?: number;\n  /**\n   * Replay the URL the WebView actually fetched, instead of the fixed template `url`. Use for\n   * endpoints whose path has a dynamic segment (e.g. a user id, like Garmin's\n   * `/userprofile-service/socialProfile/{userId}`) so native replay hits the real per-user URL.\n   * The captured URL is still constrained to the pinned host and the endpoint's match rules.\n   */\n  replayCapturedUrl?: boolean;\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderTemplate {\n  schemaVersion: string;\n  providerId: string;\n  name: string;\n  iconUrl?: string;\n  login: SatyaProviderLogin;\n  auth?: Record<string, unknown>;\n  endpoints: SatyaProviderEndpoint[];\n  selectedEndpointId?: string;\n  /** SDK-normalized compatibility fields used by native replay. */\n  label?: string;\n  description?: string;\n  displayName?: string;\n  version?: string;\n  target?: {\n    scheme: 'https';\n    host: string;\n    port: number;\n  };\n  webLogin?: {\n    startUrl: string;\n    callbackUrl?: string;\n    oauthHosts?: string[];\n  };\n  userAgent?: {\n    ios?: string | null;\n    android?: string | null;\n  } | null;\n  /**\n   * Provider-owned JavaScript to run inside the managed WebView on every page,\n   * alongside the SDK request interceptor. Provider registries are trusted policy:\n   * do not load this field from an untrusted source.\n   */\n  injection?: SatyaProviderInjection | null;\n  proofTarget?: {\n    method: string;\n    url: string;\n    requestMatchRules: Record<string, unknown>[];\n    revealRules: Record<string, unknown>[];\n    [key: string]: unknown;\n  };\n  privacyPolicy?: {\n    allowedRequestHeaders: string[];\n    /**\n     * JSON paths the proof may read from the response body. Subset of\n     * {@link ResponseRevealRule}s whose type is `json` or `jsonRegex`. Kept for\n     * backward compatibility; native extraction prefers `allowedResponseReveals`.\n     */\n    allowedResponseBodyJsonPaths: string[];\n    /**\n     * Structured response reveals the native replay extracts into disclosed claims.\n     * Supports JSON paths plus regex (over the raw HTML/text/JSON body) and jsonRegex\n     * (a JSON-path-selected value run through a regex).\n     */\n    allowedResponseReveals?: ResponseRevealRule[];\n  };\n  tlsPolicy?: {\n    requireTls13: boolean;\n    allowZeroRtt: boolean;\n    allowResumption: boolean;\n    allowKeyUpdate: boolean;\n    preferredCipher: string;\n    maxSentBytes: number;\n    maxRecvBytes: number;\n  };\n  tlsIdentityPolicy: {\n    expectedSni: string;\n    allowedAlpn?: string[];\n    spkiSha256Hex?: string | null;\n    spkiSha256B64Pins?: string[];\n    tlsTrustStorePolicy?: 'web-pki-os-roots-no-user-roots';\n    userRootsAllowed?: false;\n    redirectPolicyId?: string;\n  };\n  templateGovernance: {\n    templateHash: string;\n    parserHash: string;\n    fixtureSetHash?: string;\n    governancePolicyVersion?: string;\n    providerActivationState?: string;\n  };\n  [key: string]: unknown;\n}\n\nexport interface SatyaProviderPolicy {\n  providerId: string;\n  host: string;\n  templateHash: string;\n  parserHash: string;\n  providerActivationState: string;\n  spkiSha256B64Pins: string[];\n}\n\nexport interface CapturedProviderRequest {\n  url: string;\n  method: string;\n  headers: Record<string, string>;\n  body?: string | null;\n}\n\nexport interface CapturedProviderResponse {\n  url: string;\n  status: number;\n  headers: Record<string, string>;\n  body?: string | null;\n}\n\nexport interface NativeReplayTlsEvidence {\n  serverCertChainSha256Hex: string;\n  sni: string;\n  alpn: string;\n  tlsVersion: string;\n  tlsTrustStorePolicy: 'web-pki-os-roots-no-user-roots';\n  userRootsAllowed: false;\n  matchedSpkiSha256B64?: string | null;\n  expectedSpkiPinsB64: string[];\n}\n\nexport interface NativeReplayClaim {\n  name: string;\n  sourcePath: string;\n  value: unknown;\n}\n\nexport interface NativeReplayObservation {\n  providerId: string;\n  templateHash: string;\n  host: string;\n  method: string;\n  pathAndQuery: string;\n  statusCode: number;\n  finalUrl: string;\n  contentType?: string | null;\n  contentEncoding?: string | null;\n  responseSha256Hex: string;\n  claims: NativeReplayClaim[];\n  tlsEvidence: NativeReplayTlsEvidence;\n}\n\n/** Structured verifier outcome returned by the Rust core. */\nexport interface VerifyResult {\n  ok: boolean;\n  attestationId: string;\n  mode: string;\n  platformTier: string;\n  /** `dev-local` for the mock tier, `dev-device` for attested/simulator tiers. */\n  policy: string;\n  disclosedUsername?: string | null;\n  error?: string | null;\n}\n\n/**\n * The decoded SATYA-W artifact. Only the commonly-read fields are typed; the rest\n * of the (camelCase) graph is preserved under the index signature.\n */\nexport interface SatyaArtifact {\n  schemaVersion: string;\n  attestationId: string;\n  createdAtUtc: string;\n  mode: SatyaArtifactMode;\n  statement: Record<string, unknown>;\n  semanticStatement: Record<string, unknown>;\n  /** Legacy/full artifact disclosure. Compact native replay artifacts use disclosedClaims instead. */\n  disclosure?: Record<string, unknown>;\n  witnessCommitment: Record<string, unknown>;\n  witnessSignature: Record<string, unknown>;\n  notarySignature: Record<string, unknown>;\n  /** Legacy operational metrics. New proof artifacts omit this field. */\n  telemetry?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/** Error thrown by the high-level client. */\nexport class SatyaError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SatyaError';\n  }\n}\n"]}

package/build/SatyaProviderAttestButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaProviderAttestButton.d.ts","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAcjF,OAAO,EACL,uBAAuB,EAGvB,UAAU,EAEV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AA+BvE,KAAK,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAmBrE,MAAM,MAAM,sBAAsB,GAC9B,MAAM,GACN,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,UAAU,GACV,QAAQ,GACR,WAAW,GACX,UAAU,CAAC;AAEf,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,8BAA+B,SAAQ,aAAa;IACnE,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;IACvD,eAAe,EAAE,oBAAoB,CAAC;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;IAC3D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAChG,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAiBD,wBAAgB,yBAAyB,CAAC,EACxC,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,QAAQ,EACR,qBAAwC,EACxC,eAAe,EACf,MAAM,EAAE,cAAc,EACtB,aAAqB,EACrB,WAAoC,EACpC,QAAgB,EAChB,UAAU,EACV,mBAA0B,EAC1B,gBAAgB,EAAE,eAAe,EACjC,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,QAAQ,GACT,EAAE,8BAA8B,qBA0+BhC"}
+{"version":3,"file":"SatyaProviderAttestButton.d.ts","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAC;AAcjF,OAAO,EACL,uBAAuB,EAGvB,UAAU,EAEV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAkEvE,KAAK,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAmBrE,MAAM,MAAM,sBAAsB,GAC9B,MAAM,GACN,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,UAAU,GACV,QAAQ,GACR,WAAW,GACX,UAAU,CAAC;AAEf,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,8BAA+B,SAAQ,aAAa;IACnE,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;IACvD,eAAe,EAAE,oBAAoB,CAAC;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;IAC3D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAChG,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAiBD,wBAAgB,yBAAyB,CAAC,EACxC,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,QAAQ,EACR,qBAAwC,EACxC,eAAe,EACf,MAAM,EAAE,cAAc,EACtB,aAAqB,EACrB,WAAoC,EACpC,QAAgB,EAChB,UAAU,EACV,mBAA0B,EAC1B,gBAAgB,EAAE,eAAe,EACjC,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,QAAQ,GACT,EAAE,8BAA8B,qBAiiChC"}

package/build/SatyaProviderAttestButton.js

@@ -6,6 +6,31 @@ import { SatyaMobileClient } from './SatyaMobileClient';
 import { fetchVerifierProviderPolicy, validateProviderPolicyForTemplate } from './providerPolicy';
 import { loadProviderRegistry, requestMatchesProviderTemplate, requireProviderTemplate, validateProviderTemplate, withProviderSpkiPins, } from './providerRegistry';
 import { buildActiveFetchScript, buildProviderDocumentStartScript, buildProviderPopupBridgeScript, buildProviderWebViewScript, } from './providerWebview';
+// Native-replay host retarget (see Garmin connectapi): capture the SPA's request on the
+// browser-reachable cookie host, then rewrite it to the pinned API host and inject the DI
+// bearer so the native (non-CORS, non-Cloudflare) pinned replay can run. The replay host is
+// fixed by trusted template config (`toHost` == pinned expectedSni); only the path comes from
+// the captured (match-rule-constrained) request.
+function rewriteForNativeReplay(request, template, bearer) {
+    const proof = template.proofTarget;
+    const rw = proof?.nativeReplayRewrite;
+    let url = request.url;
+    const headers = { ...request.headers };
+    if (rw?.fromHost && rw?.toHost) {
+        const fromBase = `https://${rw.fromHost}`;
+        if (url.startsWith(fromBase)) {
+            let rest = url.slice(fromBase.length);
+            if (rw.stripPathPrefix && rest.startsWith(rw.stripPathPrefix)) {
+                rest = rest.slice(rw.stripPathPrefix.length);
+            }
+            url = `https://${rw.toHost}${rest}`;
+        }
+    }
+    if (proof?.nativeReplayInjectBearer && bearer) {
+        headers.authorization = `Bearer ${bearer}`;
+    }
+    return { ...request, url, headers };
+}
 const EMPTY_BROWSER_CHROME = {
     url: '',
     title: '',
@@ -29,6 +54,13 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
     // For `triggerFromInjection` endpoints: the last matching request seen, held until its
     // response arrives 2xx (login gate) before the native replay is allowed to run.
     const pendingRequestRef = useRef(null);
+    // DI bearer token lifted from the live provider session (e.g. Garmin connectapi), injected
+    // into the native replay request for hosts that require Authorization: Bearer.
+    const bearerRef = useRef(null);
+    // Login-signal gate: provider `injection` posts `__satyaReady` once the proof endpoint
+    // returns authenticated content. Some endpoints (e.g. Garmin /proxy/socialProfile) return
+    // 200 with an empty body pre-login, which a status-only 2xx gate can't distinguish.
+    const loggedInRef = useRef(false);
     const [modalVisible, setModalVisible] = useState(false);
     const [phase, setPhase] = useState('idle');
     const [percent, setPercent] = useState(0);
@@ -84,6 +116,8 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
         replayStartedRef.current = false;
         htmlCaptureFetchedRef.current.clear();
         pendingRequestRef.current = null;
+        bearerRef.current = null;
+        loggedInRef.current = false;
         setRunning(true);
         setCapturedRequest(null);
         setError(null);
@@ -207,7 +241,7 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
                     providerId: template.providerId,
                 });
                 try {
-                    backendVerify = await postBackendVerifier(transportConfig.notaryUrl, outcome.raw);
+                    backendVerify = await postBackendVerifier(transportConfig.notaryUrl, outcome.raw, transportConfig.verifierBearerToken);
                 }
                 catch (cause) {
                     const message = cause instanceof Error ? cause.message : String(cause);
@@ -335,15 +369,16 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
         });
     }, [emitProgress, providerId, providerTemplate?.providerId, resolved?.template.providerId]);
     const captureAndReplay = useCallback((request, template) => {
-        setCapturedRequest(request);
-        onRequestCaptured?.(request, template);
+        const replayRequest = rewriteForNativeReplay(request, template, bearerRef.current);
+        setCapturedRequest(replayRequest);
+        onRequestCaptured?.(replayRequest, template);
         emitProgress({
             phase: 'requestCaptured',
             message: `Matched ${providerDisplayName(template)} request captured`,
             percent: 0.08,
             providerId: template.providerId,
         });
-        runReplay(request, template).catch(fail);
+        runReplay(replayRequest, template).catch(fail);
     }, [emitProgress, fail, onRequestCaptured, runReplay]);
     const handleMessage = useCallback((event) => {
         invokeWebViewCallback(webViewProps?.onMessage, event);
@@ -384,6 +419,30 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
         }
         if (!resolved || replayStartedRef.current)
             return;
+        // DI bearer lifted from the live session by the provider `injection`. Store it, and if a
+        // matching request is already held waiting on it, release it to the native replay now.
+        if (message.type === '__satyaBearer') {
+            const tok = message.data;
+            if (tok)
+                bearerRef.current = tok;
+            const held = pendingRequestRef.current;
+            if (held && bearerRef.current) {
+                pendingRequestRef.current = null;
+                captureAndReplay(held, resolved.template);
+            }
+            return;
+        }
+        // Login confirmed by the provider `injection` (the proof endpoint returned authenticated
+        // content). Release any held request to the native replay now.
+        if (message.type === '__satyaReady') {
+            loggedInRef.current = true;
+            const held = pendingRequestRef.current;
+            if (held) {
+                pendingRequestRef.current = null;
+                captureAndReplay(held, resolved.template);
+            }
+            return;
+        }
         const isActiveFetch = !!resolved.template.proofTarget?.triggerFromInjection;
         // Response-gated capture for `triggerFromInjection` endpoints: the injected active
         // fetch fires the request repeatedly; only a 2xx response (i.e. the user is logged in)
@@ -395,11 +454,15 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
             const pending = pendingRequestRef.current;
             if (!pending)
                 return;
-            const ok = typeof response?.status === 'number' &&
-                response.status >= 200 &&
-                response.status < 300;
+            const ok = typeof response?.status === 'number' && response.status >= 200 && response.status < 300;
             if (!ok || !responseUrlMatchesRequest(response?.url, pending.url))
                 return;
+            // Some endpoints return 200 with an empty body pre-login (Garmin /proxy/socialProfile);
+            // when the endpoint opts into `requireLoginSignal`, wait for the injection's
+            // `__satyaReady` (authenticated content seen) before releasing the replay.
+            const requireLoginSignal = !!resolved.template.proofTarget?.requireLoginSignal;
+            if (requireLoginSignal && !loggedInRef.current)
+                return;
             pendingRequestRef.current = null;
             captureAndReplay(pending, resolved.template);
             return;
@@ -413,6 +476,14 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
             pendingRequestRef.current = message.data;
             return;
         }
+        const requireLoginSignal = !!resolved.template.proofTarget?.requireLoginSignal;
+        if (requireLoginSignal && !loggedInRef.current) {
+            // The provider `injection` polls the proof endpoint (which returns 200-empty pre-login)
+            // and posts `__satyaReady` once it sees authenticated content. Hold the latest matching
+            // request until then, then replay it.
+            pendingRequestRef.current = message.data;
+            return;
+        }
         captureAndReplay(message.data, resolved.template);
     }, [
         captureAndReplay,
@@ -685,7 +756,7 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
     // Android Modals render edge-to-edge (content under the status bar / notch), and
     // react-native's SafeAreaView applies no top inset there — so pad the chrome down by the
     // status-bar height. iOS keeps 0 (SafeAreaView already insets the notch).
-    const topInset = Platform.OS === 'android' ? StatusBar.currentHeight ?? 24 : 0;
+    const topInset = Platform.OS === 'android' ? (StatusBar.currentHeight ?? 24) : 0;
     return (<>
       <Pressable style={[styles.button, (disabled || running || modalVisible) && styles.buttonDisabled]} disabled={disabled || running || modalVisible} onPress={openFlow}>
         {running ? <ActivityIndicator color="#ffffff" style={styles.buttonSpinner}/> : null}
@@ -796,7 +867,7 @@ export function SatyaProviderAttestButton({ providerId, endpointId, providerTemp
                 <View style={styles.errorIconWrap}>
                   <Text style={styles.errorIconGlyph}>!</Text>
                 </View>
-                <Text style={styles.overlayTitle}>Couldn{'’'}t verify your account</Text>
+                <Text style={styles.overlayTitle}>Couldn't verify your account</Text>
                 <Text style={styles.overlaySubtitle}>{friendlyError(error)}</Text>
                 <Pressable style={styles.primaryAction} onPress={openFlow}>
                   <Text style={styles.primaryActionText}>Try again</Text>
@@ -828,6 +899,7 @@ async function resolveProvider(providerId, providerTemplate, providerRegistrySou
             const policy = await fetchVerifierProviderPolicy({
                 notaryUrl: transportConfig.notaryUrl,
                 providerId: base.providerId,
+                bearerToken: transportConfig.verifierBearerToken,
             });
             validateProviderPolicyForTemplate(policy, base);
             const template = withProviderSpkiPins(base, policy.spkiSha256B64Pins);
@@ -938,11 +1010,11 @@ function validateTemplateForReplay(template) {
     }
     return null;
 }
-async function postBackendVerifier(notaryUrl, artifactJson) {
+async function postBackendVerifier(notaryUrl, artifactJson, bearerToken) {
     const url = backendVerifierUrl(notaryUrl);
     const response = await fetch(url, {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
+        headers: verifierRequestHeaders(bearerToken),
         body: artifactJson,
     });
     const text = await response.text();
@@ -982,6 +1054,13 @@ async function postBackendVerifier(notaryUrl, artifactJson) {
         };
     }
 }
+function verifierRequestHeaders(bearerToken) {
+    const headers = { 'content-type': 'application/json' };
+    const token = bearerToken?.trim();
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    return headers;
+}
 function backendVerifierUrl(notaryUrl) {
     return `${notaryUrl.replace(/\/+$/, '')}/v1/artifacts/verify`;
 }