@burnt-labs/expo-satya-attest 0.2.4 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.0 - 2026-06-14
+
+- Reworked the managed provider WebView into a polished, native-feeling surface: removed the browser-style chrome (address/host bar, lock icon, reload, and close buttons) so the flow reads as a screen of the host app rather than an in-app browser.
+- Exiting the flow now uses the device's own back affordance: the hardware/gesture back button on Android, and a left-edge swipe-back gesture on iOS (which has no hardware back button). Either one dismisses an open OAuth popup first, otherwise closes the WebView — no on-screen close/back buttons.
+- Fixed WebView clipping into the notch / status bar and the home indicator / on-screen navigation bar by applying correct top, bottom, and side safe-area insets across devices. Adds `react-native-safe-area-context` as a required peer dependency (install it alongside `react-native-webview`).
+- Added an optional `theme` prop (`surfaceColor`, `onSurfaceColor`, `mutedColor`, `accentColor`, `statusBarStyle`) so the WebView surface can match the host app's brand. Pass `modalTitle=""` to hide the header title.
+
 ## 0.2.2 - 2026-06-11
 
 - Fixed provider WebView login flows that could continuously refresh while the user was still on a login or SSO host.

package/PROVIDER_CONFIG.md

@@ -22,6 +22,34 @@ provider shape inside a registry wrapper:
 The registry-level `schemaVersion` is optional in the SDK loader. Each provider entry
 must still carry its own `schemaVersion`.
 
+The current built-in provider entries use this top-level shape:
+
+```jsonc
+{
+  "schemaVersion": "1.0.0",
+  "providerId": "provider.proof.v1",
+  "name": "Provider",
+  "login": { "url": "https://provider.example/login" },
+  "endpoints": [],
+  "tlsIdentityPolicy": {
+    "expectedSni": "provider.example",
+    "spkiSha256B64Pins": []
+  },
+  "templateGovernance": {
+    "templateHash": "dev-provider-proof-v1-template",
+    "parserHash": "parser-sha256:<64 hex chars>"
+  }
+}
+```
+
+The endpoint shape is also explicit. The supported endpoint keys are `id`, `url`,
+`method`, `headers`, `responseType`, `requestMatchRules`, `revealRules`, optional
+`capture`, optional `replayCapturedUrl`, and optional `htmlCaptureBodyPattern`.
+Endpoint active-fetch/readiness settings must be grouped under endpoint `capture`.
+Endpoint `injection` and old flat endpoint fields such as `triggerFromInjection`, `injectionHeaders`,
+`injectionLandingUrl`, `injectionPollMs`, `injectionMaxAttempts`, and flat
+`requireLoginSignal` are invalid.
+
 ## Minimal Provider
 
 ```json
@@ -80,15 +108,15 @@ Required provider fields:
 
 | Field | Description |
 |---|---|
-| `schemaVersion` | Provider schema version string. The built-in registry currently uses `1.0.0`. |
-| `providerId` | Stable provider id, for example `kaggle.current_user.v1`. It must be unique within a registry. |
-| `name` | User-facing provider name. Legacy `label` and `displayName` are accepted, but new configs should use `name`. |
-| `login.url` | HTTPS page opened in the managed WebView for login and request discovery. |
-| `endpoints` | Non-empty array of proof endpoints. If no endpoint id is selected, the SDK uses the first endpoint. |
-| `tlsIdentityPolicy.expectedSni` | Expected HTTPS host/SNI. Every endpoint URL must use this same host. |
-| `tlsIdentityPolicy.spkiSha256B64Pins` | Public SPKI SHA-256 pins for native replay. Built-in providers and device E2E should keep this non-empty. |
-| `templateGovernance.templateHash` | Template identity accepted by the verifier. |
-| `templateGovernance.parserHash` | Parser identity derived from provider id, endpoint ids, response types, and reveal rules. |
+| `schemaVersion` | Provider schema version string. The built-in registry currently uses `1.0.0`. This is separate from the optional registry wrapper `schemaVersion`. |
+| `providerId` | Stable provider id, for example `kaggle.current_user.v1`. It must be unique within a registry and should include a proof name plus version suffix so verifier policy can pin it safely. |
+| `name` | User-facing provider name shown in selectors and UI surfaces. New configs should use `name`; legacy `label` and `displayName` are normalized for compatibility but are not needed for new providers. |
+| `login.url` | HTTPS page opened in the managed WebView. Pick the provider's normal sign-in or account page, not the raw API URL, so cookies are established in the WebView before capture/replay. |
+| `endpoints` | Non-empty array of proof endpoints. Each endpoint describes one replayable request and its reveal policy. If no endpoint id is selected, the SDK uses the first endpoint. |
+| `tlsIdentityPolicy.expectedSni` | Expected HTTPS host/SNI for native replay. Every endpoint URL must use this same host, and captured dynamic URLs are constrained to this host before replay. |
+| `tlsIdentityPolicy.spkiSha256B64Pins` | Base64 SHA-256 SPKI pins for the provider TLS certificate chain. Native replay requires at least one pin at runtime and fails closed when the replay connection does not match policy. |
+| `templateGovernance.templateHash` | Template identity accepted by the verifier. This ties the provider id, replay target, and policy version to verifier-side allowlists. |
+| `templateGovernance.parserHash` | Parser identity derived from provider id, endpoint ids, response types, and reveal rules. Run `npm run test:providers` after editing reveal policy; the test prints the expected value when stale. |
 
 Optional provider fields:
 
@@ -99,15 +127,15 @@ Optional provider fields:
 | `label`, `displayName` | Legacy display fields. The loader normalizes them to `name`/`label`/`displayName`. |
 | `version` | Optional version string. If omitted, the SDK infers it from the final `.vN` segment of `providerId`. |
 | `auth` | Optional object for provider-auth metadata. The current SDK preserves it but does not interpret it in the managed flow. |
-| `injection` | Optional JavaScript string, array of strings, or `null`. Runs in the managed WebView on every main and popup page alongside the SDK interceptor. |
+| `injection` | Optional provider-level JavaScript string, array of strings, or `null`. Runs in the managed WebView on every main and popup page alongside the SDK interceptor. Use it for provider-specific page navigation, login readiness checks, popup handoff, or posting `__satyaReady`. This is different from endpoint-level `capture`, which configures active fetch/readiness for one endpoint. |
 | `target` | Legacy compatibility object. If present, it must be `{ "scheme": "https", "host": expectedSni, "port": 443 }`. The loader generates this when omitted. |
 | `webLogin` | Legacy compatibility object. `login.url` is preferred. If only `webLogin.startUrl` is present, the loader maps it to `login.url`. |
-| `userAgent` | Optional `{ "ios": string | null, "android": string | null }`. Used by the managed WebView when no explicit `webViewUserAgent` prop is supplied. |
-| `tlsIdentityPolicy.allowedAlpn` | Optional ALPN metadata. Native replay measures negotiated ALPN and verifier policy checks the artifact. |
+| `userAgent` | Optional `{ "ios": string | null, "android": string | null }`. Used by the managed WebView when no explicit `webViewUserAgent` prop is supplied. Include it when a provider serves different pages/APIs to mobile and desktop agents and the replay must match the WebView. |
+| `tlsIdentityPolicy.allowedAlpn` | Optional ALPN metadata. Native replay measures negotiated ALPN and verifier policy can check the artifact. |
 | `tlsIdentityPolicy.spkiSha256Hex` | Legacy/pass-through metadata. Prefer `spkiSha256B64Pins`. |
 | `tlsIdentityPolicy.tlsTrustStorePolicy` | Optional, but if present it must be `web-pki-os-roots-no-user-roots`. The loader fills this value when omitted. |
 | `tlsIdentityPolicy.userRootsAllowed` | Optional, but if present it must be `false`. The loader fills `false` when omitted. |
-| `tlsIdentityPolicy.redirectPolicyId` | Optional redirect-policy metadata. Native replay currently blocks redirects. |
+| `tlsIdentityPolicy.redirectPolicyId` | Optional redirect-policy metadata. Native replay currently blocks redirects, so do not rely on redirects for proof requests. |
 | `templateGovernance.fixtureSetHash` | Optional fixture-set identity. Defaults to `unversioned-fixtures`. |
 | `templateGovernance.governancePolicyVersion` | Optional governance policy id. Defaults to `embedded-registry`. |
 | `templateGovernance.providerActivationState` | Optional activation state. Defaults to `experimental`; production policy should require governed active templates. |
@@ -116,6 +144,51 @@ Unknown top-level keys are cloned through the JavaScript loader, but native repl
 backend verification only rely on documented policy fields. Do not place
 security-critical behavior in an unknown key.
 
+### Provider-level injection (`provider.injection`)
+
+Top-level `injection` is trusted provider JavaScript. It runs in the managed WebView
+alongside the SDK's request/response interceptor on the main page and managed popup
+pages. Use it when the provider's normal UI needs help reaching the proof request:
+
+- navigate after login to a stable account/proof page,
+- click or submit provider UI that reveals the proof endpoint,
+- bridge popup login flows that need provider-specific handling,
+- poll the page or API for authenticated content and then post `__satyaReady`.
+
+Supported shapes:
+
+```jsonc
+// one script
+"injection": "/* provider JS */"
+
+// multiple scripts, executed as provider-owned WebView injection
+"injection": ["/* script 1 */", "/* script 2 */"]
+
+// explicit no-op
+"injection": null
+```
+
+Validation rules:
+
+- a script must be a non-empty string after trimming,
+- an array must not be empty,
+- each script is capped at 64 KiB,
+- total provider injection is capped at 128 KiB,
+- `login.injection` is invalid; provider injection always belongs at the provider top
+  level.
+
+`__satyaReady` is a message contract from provider-level injection to the SDK:
+
+```js
+window.ReactNativeWebView.postMessage(JSON.stringify({ type: '__satyaReady' }));
+```
+
+When the SDK receives that message it marks the provider session as login-ready and
+releases any matching request that was being held. Endpoint `capture.requireLoginSignal`
+opts an endpoint into this extra gate. Use it only when response status is not enough,
+for example when a provider can return a 2xx placeholder before authenticated content is
+actually available.
+
 ## Endpoints
 
 Each provider can define multiple endpoints for the same site:
@@ -136,13 +209,21 @@ Required endpoint fields:
 
 | Field | Description |
 |---|---|
-| `id` | Endpoint id. It must start with a letter and contain only letters, numbers, `_`, or `-`. |
-| `url` | HTTPS replay URL. The host must match `tlsIdentityPolicy.expectedSni`. |
-| `method` | HTTP method. Supported values are `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, and `OPTIONS`. |
-| `headers` | Non-empty request-header allowlist used by native replay. This is the collapsed replacement for `privacyPolicy.allowedRequestHeaders`. |
-| `responseType` | Response parser type. One of `json`, `html`, or `text`. `html`/`text` endpoints disclose values via `regex` reveals (see below). |
-| `requestMatchRules` | Non-empty array of rules used to detect the WebView request before native replay. |
-| `revealRules` | Non-empty array of disclosure rules. It must include at least one `RECV BODY` reveal (`json`, `regex`, or `jsonRegex`). |
+| `id` | Endpoint id. It must start with a letter, contain only letters, numbers, `_`, or `-`, and be unique within the provider. Use stable ids like `primary`, `profile`, or `orders` because the id participates in `parserHash`. |
+| `url` | HTTPS replay URL. The host must match `tlsIdentityPolicy.expectedSni`. For fixed API endpoints this is the exact URL native replay uses. For `replayCapturedUrl` endpoints it is a stable template/prefix that still pins the expected host. |
+| `method` | HTTP method. Supported values are `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, and `OPTIONS`. It must agree with the required `methodEquals` request match rule. |
+| `headers` | Non-empty request-header allowlist used by native replay. Only these captured/requested headers may be forwarded to the native replay. Include `cookie` for cookie-authenticated endpoints and `user-agent` when provider behavior depends on it. Endpoint `capture.headers` are automatically added to this allowlist. |
+| `responseType` | Response parser type. One of `json`, `html`, or `text`. `json` endpoints can use `json`, `jsonRegex`, or `regex` reveals. `html`/`text` endpoints disclose values via `regex` reveals only. |
+| `requestMatchRules` | Non-empty array of rules used to detect the WebView request before native replay. The current validator requires a method rule and a URL rule. Keep these narrow enough that the SDK captures the intended proof request only. |
+| `revealRules` | Non-empty array of disclosure rules. It must include at least one `RECV BODY` reveal (`json`, `regex`, or `jsonRegex`). These rules define the actual claims emitted in the artifact and are part of `parserHash`. |
+
+Optional endpoint fields:
+
+| Field | Description |
+|---|---|
+| `capture` | Endpoint-scoped capture/active-fetch/readiness object. Use this when the SDK must actively fire an API request from inside the WebView or hold a matched request until `__satyaReady`. This object is not provider JavaScript; provider JavaScript belongs at top-level `provider.injection`. |
+| `replayCapturedUrl` | Boolean. When `true`, native replay uses the exact URL captured from the WebView instead of the endpoint template `url`. Use for provider URLs with dynamic path/query values such as per-account user ids. The captured URL is still constrained by host/SNI and match rules. |
+| `htmlCaptureBodyPattern` | Regex string for `html`/`text` endpoints loaded by top-level navigation. The SDK waits until the current document text matches this pattern before it re-issues the page as a credentialed fetch for capture. Use it for redirect chains or pages whose proof data appears only after the settled HTML loads. |
 
 The raw endpoint schema intentionally does not include `allowedResponseBodyJsonPaths`.
 The loader derives the response reveal allowlist from `revealRules` and emits a
@@ -163,17 +244,25 @@ managed WebView lands on a URL that matches an `html`/`text` provider's
 the normal capture → native-replay path runs. A provider `injection` can drive the WebView
 to the proof page after login (the bundled HTML providers do this).
 
+For redirect chains where the final page URL is not known ahead of time, set
+`replayCapturedUrl: true` and `htmlCaptureBodyPattern` on the endpoint. The SDK waits
+until the loaded document text matches that trusted regex, then captures the current
+settled URL instead of the fixed template URL. If the endpoint must use a broad URL regex,
+add a `headerEquals` request rule for `x-satya-html-capture: 1`; the SDK adds that marker
+only to its gated HTML-capture fetch and native replay does not forward it unless the
+header is explicitly allowlisted.
+
 When `requireProviderTemplate(providerId, registry, endpointId)` is called with an
 endpoint id, that endpoint is normalized into the compatibility `proofTarget` used by
 the native modules. If no endpoint id is supplied, the first endpoint is selected.
 
-### Active-fetch trigger (`triggerFromInjection`)
+### Endpoint capture (`capture`)
 
 Some endpoints are cookie-authenticated APIs that **no page ever calls on its own** (e.g.
 `reddit.com/api/me.json`, `spotify.com/api/account-settings/v1/profile`,
 `users.roblox.com/v1/users/authenticated`). There is nothing for the interceptor to
-capture. Set `triggerFromInjection: true` and the SDK actively fires the request itself
-from inside the WebView (with cookies) once the user is logged in:
+capture. Set `capture.trigger: true` and the SDK actively fires the request itself from
+inside the WebView (with cookies) once the user is logged in:
 
 ```json
 {
@@ -182,7 +271,9 @@ from inside the WebView (with cookies) once the user is logged in:
   "method": "GET",
   "headers": ["accept", "user-agent", "cookie"],
   "responseType": "json",
-  "triggerFromInjection": true,
+  "capture": {
+    "trigger": true
+  },
   "requestMatchRules": [
     { "type": "methodEquals", "pattern": "GET" },
     { "type": "urlContains", "pattern": "/api/me.json" }
@@ -199,35 +290,40 @@ How it works:
   the injected request comes back **2xx**. Pre-login `401`s / redirects are ignored, so it
   never captures before sign-in. (Regular, page-triggered endpoints are unaffected — they
   still capture on the request.)
-- Self-terminating: stops on the first 2xx, after `injectionMaxAttempts` real fetches, or a
+- Self-terminating: stops on the first 2xx, after `capture.maxAttempts` real fetches, or a
   hard poll cap.
 
 Optional fields that pair with it:
 
 | Field | Description |
 |---|---|
-| `triggerFromInjection` | `true` to enable the active fetch for this endpoint. |
-| `injectionHeaders` | `{ name: value }` extra headers for the fetch. Values may be literals or `{{cookie:NAME}}` templates resolved from `document.cookie` at fire time (for non-httpOnly CSRF / app-id headers). Their names are auto-added to the request-header allowlist for native replay. |
-| `requestBody` | Request body for POST/PUT/PATCH (e.g. a GraphQL query). |
-| `injectionLandingUrl` | HTTPS page to navigate to if the fetch is stuck on a **sibling subdomain** of the proof host (so it becomes same-origin). Defaults to the proof origin root; set a stable signed-in page when the root redirects elsewhere. E.g. after login Spotify lands on `open.spotify.com`, so its endpoint sets `"https://www.spotify.com/account/"`. The poller tries the fetch from wherever it is first (so credentialed cross-origin CORS APIs like Roblox's still need no landing), and only hops after a couple of failures on a same-registrable-domain host — never across registrable domains (won't break a third-party SSO). |
-| `injectionPollMs` | Poll interval in ms (default `2000`, range `500`–`15000`). |
-| `injectionMaxAttempts` | Max real fetch attempts (default `60`, range `1`–`300`). |
+| `capture.trigger` | `true` to enable the active fetch for this endpoint. |
+| `capture.headers` | `{ name: value }` extra headers for the fetch. Values may be literals or `{{cookie:NAME}}` templates resolved from `document.cookie` at fire time (for non-httpOnly CSRF / app-id headers). Their names are auto-added to the request-header allowlist for native replay. |
+| `capture.requestBody` | Request body for POST/PUT/PATCH (e.g. a GraphQL query). |
+| `capture.landingUrl` | HTTPS page to navigate to if the fetch is stuck on a **sibling subdomain** of the proof host (so it becomes same-origin). Defaults to the proof origin root; set a stable signed-in page when the root redirects elsewhere. E.g. after login Spotify lands on `open.spotify.com`, so its endpoint sets `"https://www.spotify.com/account/"`. The poller tries the fetch from wherever it is first (so credentialed cross-origin CORS APIs like Roblox's still need no landing), and only hops after a couple of failures on a same-registrable-domain host — never across registrable domains (won't break a third-party SSO). |
+| `capture.pollMs` | Poll interval in ms (default `2000`, range `500`–`15000`). |
+| `capture.maxAttempts` | Max real fetch attempts (default `60`, range `1`–`300`). |
+| `capture.requireLoginSignal` | Hold a matched request until provider-level `injection` posts `__satyaReady`. Use only when a provider can return a misleading 2xx before authenticated content is available. |
 
 Examples needing headers / a body:
 
 ```jsonc
 // Instagram — constant app-id + a CSRF token read from a cookie:
-"triggerFromInjection": true,
-"injectionHeaders": {
-  "x-ig-app-id": "936619743392459",
-  "x-csrftoken": "{{cookie:csrftoken}}",
-  "x-requested-with": "XMLHttpRequest"
+"capture": {
+  "trigger": true,
+  "headers": {
+    "x-ig-app-id": "936619743392459",
+    "x-csrftoken": "{{cookie:csrftoken}}",
+    "x-requested-with": "XMLHttpRequest"
+  }
 }
 
 // DoorDash — POST GraphQL with a body:
-"triggerFromInjection": true,
-"injectionHeaders": { "content-type": "application/json" },
-"requestBody": "{\"operationName\":\"consumer\",\"variables\":{},\"query\":\"query consumer { consumer { id isGuest } }\"}"
+"capture": {
+  "trigger": true,
+  "headers": { "content-type": "application/json" },
+  "requestBody": "{\"operationName\":\"consumer\",\"variables\":{},\"query\":\"query consumer { consumer { id isGuest } }\"}"
+}
 ```
 
 Notes:
@@ -239,8 +335,27 @@ Notes:
   the same call). Same-origin APIs always work.
 - `httpOnly` cookies can't be read by `{{cookie:NAME}}` (they're sent automatically by
   `credentials:'include'` anyway; only header tokens like CSRF need templating).
-- `triggerFromInjection`, `injectionHeaders`, `requestBody`, and the poll tuning are **not**
-  part of the parser hash.
+- `capture.trigger` is for active fetches. `capture.requireLoginSignal` can also be used
+  without `capture.trigger` when the provider page naturally fires the request but the
+  SDK should hold it until provider-level injection posts `__satyaReady`.
+- `capture` active-fetch/readiness fields are **not** part of the parser hash.
+- Endpoint `injection` is invalid. Provider JavaScript still uses top-level
+  `provider.injection`.
+
+Validation rules for `capture`:
+
+- `capture` must be a non-empty object when present.
+- Supported keys are exactly `trigger`, `headers`, `requestBody`, `landingUrl`, `pollMs`,
+  `maxAttempts`, and `requireLoginSignal`.
+- `trigger` and `requireLoginSignal` must be booleans.
+- `headers` must be a non-empty object of valid HTTP header names to string values, at
+  most 20 headers. Header values must not contain newlines and are capped at 2048 chars.
+- Header names are normalized to lowercase and added to endpoint `headers` so native
+  replay is allowed to forward them.
+- `requestBody` must be a string and is capped at 32 KiB.
+- `landingUrl` must be HTTPS.
+- `pollMs` must be an integer in `[500, 15000]`.
+- `maxAttempts` must be an integer in `[1, 300]`.
 
 ### Dynamic URLs (`replayCapturedUrl`)
 
@@ -500,6 +615,8 @@ The SDK and provider test script enforce the important invariants:
 - top-level `injection` must be a non-empty string or non-empty string array when
   present,
 - `login.injection` is rejected because injection is top-level provider policy,
+- endpoint active-fetch/readiness settings must live under endpoint `capture`; endpoint
+  `injection` and flat endpoint keys are rejected,
 - SPKI pins must be SHA-256 base64 values,
 - parser hashes must match the canonical parser policy.
 
@@ -515,6 +632,6 @@ The SDK and provider test script enforce the important invariants:
 - Keep reveal rules narrow; every `RECV BODY` reveal becomes a disclosed claim. Prefer
   `json` for JSON APIs; use `regex` for HTML/text pages or to pull a substring; anchor
   regex patterns tightly (`"field":"([^"]+)"`) so they match exactly one value.
-- Treat `injection` as trusted code. Do not load registry files from untrusted hosts.
+- Treat provider `injection` as trusted code. Do not load registry files from untrusted hosts.
 - Keep backend verifier policy in sync with registry changes before making
   `providerPolicyRefresh="verifier-required"` the default for a provider.

package/README.md

@@ -94,11 +94,25 @@ Vimeo, Roblox, Skillshare, DoorDash) plus HTML/text providers that disclose valu
 regex (GitHub, Amazon, Facebook, Netflix, WordPress, Notion, DeviantArt, Zoom).
 
 The raw provider schema is documented in [`PROVIDER_CONFIG.md`](./PROVIDER_CONFIG.md).
-It uses the current hybrid shape: top-level provider metadata, top-level optional
-`injection`, a non-empty `endpoints` array, endpoint-level `headers`, request match
-rules, reveal rules, TLS identity policy, and template governance. The SDK normalizes
-the selected endpoint into the compatibility `proofTarget`/`privacyPolicy` fields used
-internally by native replay. If no endpoint id is requested, the first endpoint is used.
+The current `providers.json` shape is intentionally small and explicit:
+
+| Scope | Fields |
+|---|---|
+| Registry | `schemaVersion`, `providers` |
+| Provider | `schemaVersion`, `providerId`, `name`, `login`, `endpoints`, `tlsIdentityPolicy`, `templateGovernance`, optional `iconUrl`, `description`, `userAgent`, top-level `injection` |
+| Endpoint | `id`, `url`, `method`, `headers`, `responseType`, `requestMatchRules`, `revealRules`, optional endpoint `capture`, `replayCapturedUrl`, `htmlCaptureBodyPattern` |
+| TLS policy | `expectedSni`, `spkiSha256B64Pins` |
+| Governance | `templateHash`, `parserHash`, optional activation/governance metadata |
+
+Top-level provider `injection` is provider-owned JavaScript that runs in the managed
+WebView. Endpoint `capture` is a separate object for active-fetch/readiness settings,
+for example `{ "trigger": true, "headers": { ... } }`. Endpoint `injection` and old flat
+endpoint fields such as `triggerFromInjection` and `injectionHeaders` are no longer
+supported.
+
+The SDK normalizes the selected endpoint into the compatibility
+`proofTarget`/`privacyPolicy` fields used internally by native replay. If no endpoint id
+is requested, the first endpoint is used.
 
 ### Response types and reveal rules
 
@@ -123,15 +137,19 @@ capture → native-replay path runs; a provider `injection` can navigate to the
 after login.
 
 For cookie-authenticated APIs that **no page ever calls** (e.g. Reddit/Spotify/Roblox
-profile APIs), set `"triggerFromInjection": true` on the endpoint: the SDK actively fires
-the request from inside the WebView once you're signed in, gated on a 2xx response so it
-never captures before login. Pair it with `injectionHeaders` (literals or `{{cookie:NAME}}`
-templates, for CSRF/app-id headers) and `requestBody` (for POST). See
-[`PROVIDER_CONFIG.md`](./PROVIDER_CONFIG.md) for full details and examples.
+profile APIs), set endpoint `"capture": { "trigger": true }`: the SDK actively fires the
+request from inside the WebView once you're signed in, gated on a 2xx response so it
+never captures before login. Pair it with `capture.headers` (literals or
+`{{cookie:NAME}}` templates, for CSRF/app-id headers), `capture.requestBody` (for POST),
+`capture.landingUrl` (when the proof API lives on a sibling subdomain), and
+`capture.requireLoginSignal` (only when a provider script must post `__satyaReady`
+before replay). See [`PROVIDER_CONFIG.md`](./PROVIDER_CONFIG.md) for full details and
+examples.
 
 Provider templates may include top-level `injection` JavaScript, as a string or string
 array, when a provider needs page automation during login/request discovery. The managed
 WebView runs those scripts with the SDK network interceptor on every main and popup page.
+Endpoint-level `capture` is a separate object for active-fetch/readiness settings.
 
 Useful exports:
 
@@ -162,10 +180,10 @@ endpoint response types, and reveal rules. Run `npm run test:providers` after ed
 
 ## Installation Options
 
-Every install path also needs the WebView peer dependency:
+Every install path also needs the WebView and safe-area peer dependencies:
 
 ```bash
-npx expo install react-native-webview
+npx expo install react-native-webview react-native-safe-area-context
 ```
 
 Use npm for released apps:
@@ -184,7 +202,7 @@ npm run check:native-artifacts
 
 cd /path/to/your-expo-app
 npm install /path/to/tls-app-attest/platform_sdks/expo-satya-attest
-npx expo install react-native-webview
+npx expo install react-native-webview react-native-safe-area-context
 ```
 
 Re-run `npm run build` in the SDK directory after TypeScript edits. Re-run the native
@@ -197,7 +215,7 @@ would publish:
 
 ```bash
 npm install https://github.com/<owner>/<repo>/releases/download/expo-satya-attest-v0.2.2/burnt-labs-expo-satya-attest-0.2.2.tgz
-npx expo install react-native-webview
+npx expo install react-native-webview react-native-safe-area-context
 ```
 
 Installing from a Git ref also works when that ref has the SDK package at the repository
@@ -206,7 +224,7 @@ root, such as a dedicated SDK repo or a subtree/split branch:
 ```bash
 npm install github:<owner>/<sdk-repo>#v0.2.2
 npm install git+https://github.com/<owner>/<sdk-repo>.git#v0.2.2
-npx expo install react-native-webview
+npx expo install react-native-webview react-native-safe-area-context
 ```
 
 Do not point npm at the monorepo root unless that Git ref is prepared so

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.satyaattest'
-version = '0.2.4'
+version = '0.3.0'
 
 android {
   namespace "expo.modules.satyaattest"
   defaultConfig {
     versionCode 1
-    versionName "0.2.4"
+    versionName "0.3.0"
     // StrongBox key attestation needs API 28+; basic Keystore attestation API 24+.
     minSdkVersion 24
   }

package/android/src/main/java/expo/modules/satyaattest/SatyaAttestModule.kt

@@ -77,6 +77,8 @@ private const val MAX_RESPONSE_BODY_BYTES = 8L * 1024 * 1024
 private const val PLAY_INTEGRITY_BIND_DOMAIN = "satya-w-playintegrity-bind-v1"
 
 class SatyaAttestModule : Module() {
+  private data class BoundedResponseBody(val bytes: ByteArray, val text: String)
+
   @Volatile private var transportConfigJson: String = "{}"
   private val documentStartScriptHandlers = mutableMapOf<Int, ScriptHandler>()
 
@@ -541,11 +543,11 @@ class SatyaAttestModule : Module() {
       // legacy json-path-only policy for older normalized templates.
       val reveals = privacyPolicy.optJSONArray("allowedResponseReveals")
       val claims = if (reveals != null && reveals.length() > 0) {
-        extractRevealClaims(responseBody, reveals)
+        extractRevealClaims(responseBody.text, reveals)
       } else {
         val jsonPaths = privacyPolicy.getJSONArray("allowedResponseBodyJsonPaths")
         val claimAliases = responseClaimAliases(template, jsonPaths)
-        extractClaims(responseBody, jsonPaths, claimAliases)
+        extractClaims(responseBody.text, jsonPaths, claimAliases)
       }
       require(claims.length() > 0) { "native replay response did not contain any allowed claim value" }
 
@@ -562,7 +564,7 @@ class SatyaAttestModule : Module() {
         put("finalUrl", response.request.url.toString())
         put("contentType", response.header("content-type"))
         put("contentEncoding", response.header("content-encoding"))
-        put("responseSha256Hex", hex(sha256(responseBody.toByteArray())))
+        put("responseSha256Hex", hex(sha256(responseBody.bytes)))
         put("claims", claims)
         put(
           "tlsEvidence",
@@ -602,6 +604,18 @@ class SatyaAttestModule : Module() {
   private fun capturedRequestMatchesRule(rule: JSONObject, captured: JSONObject): Boolean {
     return when (rule.optString("type")) {
       "urlContains" -> captured.optString("url").contains(rule.optString("pattern"))
+      "urlRegex" -> {
+        val pattern = rule.optString("pattern")
+        pattern.isNotBlank() && runCatching {
+          val regex = Regex(pattern)
+          val url = captured.optString("url")
+          val pathAndQuery = runCatching {
+            val parsed = URL(url)
+            parsed.path + (parsed.query?.let { "?$it" } ?: "")
+          }.getOrDefault("")
+          regex.containsMatchIn(url) || (pathAndQuery.isNotEmpty() && regex.containsMatchIn(pathAndQuery))
+        }.getOrDefault(false)
+      }
       "methodEquals" -> captured.optString("method").uppercase() == rule.optString("pattern").uppercase()
       "headerEquals" -> {
         val key = rule.optString("key").lowercase()
@@ -795,9 +809,13 @@ class SatyaAttestModule : Module() {
         else -> null
       }
       if (value == null || value == JSONObject.NULL) continue
+      // For json/jsonRegex the disclosure is keyed by the JSON path it was read from. For a
+      // pure regex reveal there is no JSON path, so key the disclosure by the (validated,
+      // unique) alias — a single-segment JSON path the core can insert + read back, instead
+      // of the synthetic "regex(...)" string the core would wrongly parse as a JSON path.
       val sourcePath = when (type) {
         "json", "jsonRegex" -> path
-        else -> "regex(${reveal.optString("pattern")})"
+        else -> alias
       }
       claims.put(
         JSONObject().apply {
@@ -832,14 +850,15 @@ class SatyaAttestModule : Module() {
 
   // Read the response body with an upper size bound (regex/JSON extraction runs on the
   // full string). Buffers one byte past the cap to detect oversize bodies, then rejects.
-  private fun readBoundedResponseBody(response: okhttp3.Response): String {
-    val responseBody = response.body ?: return ""
+  private fun readBoundedResponseBody(response: okhttp3.Response): BoundedResponseBody {
+    val responseBody = response.body ?: return BoundedResponseBody(ByteArray(0), "")
     val source = responseBody.source()
     source.request(MAX_RESPONSE_BODY_BYTES + 1)
     require(source.buffer.size <= MAX_RESPONSE_BODY_BYTES) {
       "native replay response exceeds $MAX_RESPONSE_BODY_BYTES bytes"
     }
-    return responseBody.string()
+    val bytes = responseBody.bytes()
+    return BoundedResponseBody(bytes, bytes.toString(Charsets.UTF_8))
   }
 
   private fun jsonPathGet(root: Any, path: String): Any? {

package/build/SatyaAttest.types.d.ts

@@ -92,14 +92,7 @@ export interface SatyaProviderLogin {
     url: string;
     [key: string]: unknown;
 }
-export interface SatyaProviderEndpoint {
-    id: string;
-    url: string;
-    method: string;
-    headers: string[];
-    responseType: string;
-    requestMatchRules: Record<string, unknown>[];
-    revealRules: Record<string, unknown>[];
+export interface SatyaProviderEndpointCapture {
     /**
      * When true, the SDK actively fires this endpoint's request from inside the managed
      * WebView (via an injected `fetch`) once the user is logged in, instead of waiting for
@@ -107,14 +100,14 @@ export interface SatyaProviderEndpoint {
      * the native replay before login. Use for cookie-authenticated APIs that no page calls
      * on its own (e.g. Reddit/Spotify/Roblox profile APIs).
      */
-    triggerFromInjection?: boolean;
+    trigger?: boolean;
     /**
-     * Extra request headers for the injected active fetch (only used with
-     * `triggerFromInjection`). Values may be literals or `{{cookie:NAME}}` templates resolved
-     * from `document.cookie` at fire time (for non-httpOnly CSRF/app-id headers). Header
-     * names are automatically added to the request-header allowlist for native replay.
+     * Extra request headers for the injected active fetch. Values may be literals or
+     * `{{cookie:NAME}}` templates resolved from `document.cookie` at fire time (for
+     * non-httpOnly CSRF/app-id headers). Header names are automatically added to the
+     * request-header allowlist for native replay.
      */
-    injectionHeaders?: Record<string, string>;
+    headers?: Record<string, string>;
     /** Request body for the injected active fetch (POST/PUT/PATCH endpoints). */
     requestBody?: string;
     /**
@@ -123,11 +116,29 @@ export interface SatyaProviderEndpoint {
      * on `www.spotify.com`). Prefer a stable signed-in page that itself loads the proof API.
      * Defaults to the proof origin root (`https://<host>/`) when omitted.
      */
-    injectionLandingUrl?: string;
+    landingUrl?: string;
     /** Poll interval in ms for the active fetch (default 2000, bounded 500..15000). */
-    injectionPollMs?: number;
+    pollMs?: number;
     /** Max active-fetch attempts before giving up (default 60, bounded 1..300). */
-    injectionMaxAttempts?: number;
+    maxAttempts?: number;
+    /**
+     * Holds a matched request until provider-owned top-level `injection` posts
+     * `__satyaReady`. Use only for providers where a status-only 2xx login gate is not
+     * enough to prove authenticated content is available.
+     */
+    requireLoginSignal?: boolean;
+    [key: string]: unknown;
+}
+export interface SatyaProviderEndpoint {
+    id: string;
+    url: string;
+    method: string;
+    headers: string[];
+    responseType: string;
+    requestMatchRules: Record<string, unknown>[];
+    revealRules: Record<string, unknown>[];
+    /** Endpoint-scoped capture/active-fetch/readiness config. */
+    capture?: SatyaProviderEndpointCapture;
     /**
      * Replay the URL the WebView actually fetched, instead of the fixed template `url`. Use for
      * endpoints whose path has a dynamic segment (e.g. a user id, like Garmin's
@@ -135,6 +146,12 @@ export interface SatyaProviderEndpoint {
      * The captured URL is still constrained to the pinned host and the endpoint's match rules.
      */
     replayCapturedUrl?: boolean;
+    /**
+     * For `html`/`text` proof pages loaded by top-level navigation, only re-issue the
+     * current document URL for capture once the loaded document text matches this trusted
+     * regex. Useful for redirect chains where the proof data appears only on the settled page.
+     */
+    htmlCaptureBodyPattern?: string;
     [key: string]: unknown;
 }
 export interface SatyaProviderTemplate {

package/build/SatyaAttest.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttest.types.d.ts","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,UAAU,GACV,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB;IAAE,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GACnC,8BAA8B,CAAC;AAEnC,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC;;;;WAIG;QACH,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACvC;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC/C,CAAC;IACF,SAAS,CAAC,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;QACvD,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,gBAAgB,EAAE,KAAK,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6CAA6C;AAC7C,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"SatyaAttest.types.d.ts","sourceRoot":"","sources":["../src/SatyaAttest.types.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,UAAU,GACV,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB;IAAE,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GACnC,8BAA8B,CAAC;AAEnC,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,4BAA4B,CAAC;IACvC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC;;;;WAIG;QACH,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACvC;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC/C,CAAC;IACF,SAAS,CAAC,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;QACvD,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,gBAAgB,EAAE,KAAK,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6CAA6C;AAC7C,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}