@burnt-labs/expo-satya-attest 3.1.0 → 3.2.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 3.2.0 - 2026-08-07
+
+### Added
+
+- An opt-in, SDK-only TeeLS hosted passthrough selected with
+  `initSatyaAttest({ providerId, appId, teelsFlow: true })`. The flow preserves
+  normal provider grants, performs one existing provider-policy access preflight,
+  opens the registry login URL in an origin-bound WebView bridge, and returns the
+  opaque JSON result through `onTeelsComplete` without native replay, SATYA
+  artifact construction, local verification, or verifier artifact submission.
+- TeeLS-specific progress phases and errors for null/invalid results, hosted
+  failures, timeout, and WebView failure. The feature is disabled by default;
+  omitting `teelsFlow` in a later init restores native routing for subsequently
+  mounted buttons.
+
 ## 3.1.0 - 2026-07-31
 
 ### Added

package/PROVIDER_CONFIG.md

@@ -564,6 +564,72 @@ unrelated to the registry catalog flag `metadata.isSatyaReady`.)
 > This is distinct from endpoint `capture`: `injection` is page JavaScript at the provider
 > level; `capture` is per-endpoint active-fetch/readiness config.
 
+### Hosted TeeLS passthrough provider injection
+
+An SDK session initialized with `teelsFlow: true` may use a normal granted
+provider as a hosted TeeLS passthrough. There is no Registry flow discriminator:
+the SDK binds TeeLS mode to the configured provider/app pair, performs the
+normal provider-policy access preflight, opens `login.url`, and skips request
+capture and native replay.
+
+Keep the provider structurally valid for the normal Registry. Its existing
+endpoint, SNI, pins, grants, and verifier policy remain ordinary provider
+policy even though the TeeLS attempt does not fire or replay that endpoint.
+The hosted page origin may therefore differ from the inert endpoint/SNI host;
+the TeeLS WebView origin is always derived from `login.url`, while the access
+preflight continues to validate the governed provider policy.
+
+Generate the canonical adapter injection from the Expo SDK checkout:
+
+```bash
+cd platform_sdks/expo-satya-attest
+node scripts/generate-hosted-teels-provider-injection.js \
+  --origin https://hosted-teels.example \
+  --json
+```
+
+Put the resulting JSON string in the provider's top-level `injection`. The
+adapter is additive. It reuses, in order:
+
+1. standard `TeeLS.create({ onSuccess, onError })` callbacks by intercepting the
+   initial `window.TeeLS` assignment before the hosted bundle runs;
+2. the `teels:attestation` `CustomEvent`, reading
+   `event.detail.attestation` and optional `event.detail.data`; and
+3. the durable `window.__teels.attestation` snapshot for success recovery when
+   the adapter attaches after completion.
+
+The adapter calls the page's original callbacks first and forwards to SATYA in
+`finally`, preserving callback arguments, `this`, return values, thrown errors,
+the returned TeeLS handle, and every other TeeLS SDK export. The second argument
+to SATYA is always the attestation; if present, the first `onSuccess` argument is
+forwarded as `claimData` and added to the completion payload as `claimData`.
+Null success maps to `attestation_missing`; all other TeeLS errors map to
+`teels_flow_failed`.
+The SDK bridge and adapter both enforce exactly-once terminal settlement.
+
+The terminal API is distinct from native login readiness and supports the optional
+`claimData` passthrough:
+
+```js
+window.__SATYA_TEELS_BRIDGE__.complete(attestation, claimData);
+window.__SATYA_TEELS_BRIDGE__.fail('attestation_missing');
+window.__SATYA_TEELS_BRIDGE__.fail('teels_flow_failed');
+```
+
+Do not emit or overload `__satyaReady` for TeeLS completion. Do not post the
+opaque result through the native-replay interceptor. The adapter must remain
+main-frame and exact-origin scoped and must tolerate being evaluated only once;
+SATYA installs the bridge before executing the Registry injection.
+
+Success can be recovered from the durable snapshot after a late injection, but
+a past error cannot. Before using a hosted provider beyond development, prove
+on physical iOS and Android—both with the external TeeLS bundle cached and
+uncached—that `injectedJavaScriptBeforeContentLoaded` wraps `TeeLS.create`
+before the page calls it. If that ordering cannot be established, add a minimal
+page-owned error seam instead of relying on best-effort console interception.
+Also confirm the hosted TeeLS SDK invokes its configured `onError` for every
+terminal failure; a rendered SDK error alone cannot be observed by the adapter.
+
 ---
 
 ## 10. Writing regex patterns (HTML / text bodies)

package/README.md

@@ -26,6 +26,9 @@ with `CONFIG_INVALID`. An unregistered or unapproved id fails at the verifier
 with `APP_NOT_REGISTERED` / `APP_DISABLED`, and an ungranted provider fails with
 `PROVIDER_ACCESS_DENIED`. See
 [`docs/MULTI_TENANT_VERIFICATION.md`](../../docs/MULTI_TENANT_VERIFICATION.md).
+Flows also fail with `app_platform_not_configured` when the app has no
+registered identity for the current platform, so register every platform you
+develop and test on.
 
 ## Current Flow
 
@@ -51,6 +54,113 @@ The earlier mock and plain `webview-observed` modes are no longer exposed throug
 high-level Expo client because they do not prove a provider response fetched through a
 pinned native TLS connection.
 
+## TeeLS Hosted Passthrough (Opt-In)
+
+The SDK also has an isolated, opt-in TeeLS hosted flow. It uses a normal
+registry provider and the normal app/provider grant, but it does **not** run
+request capture, native replay, SATYA artifact construction, local SATYA
+verification, or verifier artifact submission. SATYA performs one provider-policy
+request before opening the WebView solely to confirm that the configured app is
+active and has access to the provider.
+
+Enable the flow for exactly one provider/app pair at initialization:
+
+```tsx
+import {
+  initSatyaAttest,
+  SatyaProviderAttestButton,
+  type SatyaTeelsAttestation,
+  type SatyaTeelsClaimData,
+} from '@burnt-labs/expo-satya-attest';
+
+initSatyaAttest({
+  providerId: 'satya.teels.v1',
+  appId: 'app_your-registered-app-id',
+  teelsFlow: true,
+});
+
+function TeelsAttestButton() {
+  const verifyTeelsResult = async (
+    attestation: SatyaTeelsAttestation,
+    claimData?: SatyaTeelsClaimData
+  ) => {
+    // Required: verify the TeeLS quote, freshness, and expected data binding
+    // in your application or backend before trusting the result.
+    // `claimData` is the first argument to TeeLS success, usually the
+    // JSON-safe payload forwarded by the hosted provider.
+  };
+
+  return (
+    <SatyaProviderAttestButton
+      providerId="satya.teels.v1"
+      transportConfig={{
+        verifierUrl: 'https://satya-verifier-v2-staging.burnt.com',
+        appId: 'app_your-registered-app-id',
+      }}
+      onTeelsComplete={verifyTeelsResult}
+      onError={(error) => console.error(error.code, error.message)}
+    />
+  );
+}
+```
+
+The provider's existing `login.url` opens in the SDK WebView and its normal
+Registry `injection` adapts the hosted page to the SDK-owned bridge. A page that
+already uses the standard TeeLS callbacks and EarnOS success event/snapshot
+does not need frontend changes. See
+[Provider Config](./PROVIDER_CONFIG.md#hosted-teels-passthrough-provider-injection)
+for the adapter and device-validation contract.
+
+Only a non-null, JSON-safe attestation object can complete the flow. If provided,
+`claimData` is additionally forwarded as a second argument to `onTeelsComplete`.
+Success is returned only through `onTeelsComplete`; invalid/null data, hosted
+failures, timeout, WebView failure, and access denial use the normal `onError`
+path. Closing the sheet before a terminal result uses `onCancel`.
+
+Native-replay-only props are not used by TeeLS. A component may keep an
+`onComplete` handler for normal mode, but TeeLS never calls it. Initialize the
+SDK before mounting the button. A later init with `teelsFlow: false` or with
+the option omitted disables TeeLS for subsequently mounted buttons; normal
+providers continue to use the existing native replay flow unchanged.
+
+The returned object is an opaque, unverified TeeLS result and is delivered as
+the first argument. `claimData` is the hosted-provider payload whose inner
+`data` object is hashed into the quote's `report_data`; treat both as
+untrusted input until verified. Do not treat callback delivery as a SATYA
+verification claim, and do not log or persist the result by default.
+
+### Verifying the TeeLS result
+
+The SATYA SDK performs no verification of the TeeLS result — it neither
+verifies the quote nor checks that the claim data matches it. Before trusting
+the result, the consuming application or its backend must verify it:
+
+1. **DCAP quote.** `attestation.quote` is a hex-encoded Intel TDX quote. Post
+   it to the independent TeeLS verifier service and require `success: true`,
+   `quote.verified: true`, and a `tcb_status` your policy accepts:
+
+   ```bash
+   curl -X POST https://attest.burnt.com/verify \
+     -H 'content-type: application/json' \
+     -d '{"hex":"<quote hex>"}'
+   ```
+
+2. **Measurements.** Compare the verified quote's `mrtd` and `rtmr0`–`rtmr3`
+   against the expected-measurements registry published independently by the
+   verifier (`GET https://attest.burnt.com/measurements`); require a match
+   against one of its `valid[]` sets.
+3. **Data binding.** Use `reportdata` from the **verified quote response**
+   (never the advisory `attestation.reportDataHex` field — it is
+   server-supplied). Its first 32 bytes must equal
+   `SHA-256(JSON.stringify(data))` over the exact result-data object the page
+   delivered (in this flow, `claimData.data`; remaining bytes are
+   zero-padded). When the provider binds a policy hash, the envelope is
+   `{ data, policyHash }` instead of bare `data`. Any mismatch means the claim
+   data was substituted after attestation.
+
+The result carries no nonce, so enforce your own freshness and replay policy
+wherever the attestation crosses a trust boundary.
+
 ## Native Trust Tiers
 
 | Platform         | Witness key                           | Platform evidence                | Typical tier                                                                        |

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.satyaattest'
-version = '3.1.0'
+version = '3.2.0'
 
 android {
   namespace "expo.modules.satyaattest"
   defaultConfig {
     versionCode 1
-    versionName "3.1.0"
+    versionName "3.2.0"
     // StrongBox key attestation needs API 28+; basic Keystore attestation API 24+.
     minSdkVersion 24
   }

package/build/SatyaProviderAttestButton.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
 import type { SatyaProviderAttestButtonProps } from './components/providerAttest/types';
-export type { SatyaBackendVerifyResult, SatyaProviderAttestButtonProps, SatyaProviderAttestationResult, SatyaProviderAttestPresentation, SatyaProviderAttestTheme, SatyaProviderFlowPhase, SatyaProviderFlowProgress, } from './components/providerAttest/types';
+export type { SatyaBackendVerifyResult, SatyaProviderAttestButtonProps, SatyaProviderAttestationResult, SatyaProviderAttestPresentation, SatyaProviderAttestTheme, SatyaProviderFlowPhase, SatyaProviderFlowProgress, SatyaTeelsAttestation, SatyaTeelsClaimData, } from './components/providerAttest/types';
 export declare function SatyaProviderAttestButton(props: SatyaProviderAttestButtonProps): React.JSX.Element;
 //# sourceMappingURL=SatyaProviderAttestButton.d.ts.map

package/build/SatyaProviderAttestButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaProviderAttestButton.d.ts","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAGxF,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,qBAoC9E"}
+{"version":3,"file":"SatyaProviderAttestButton.d.ts","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAUxC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAOxF,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,qBAiB9E"}

package/build/SatyaProviderAttestButton.js

@@ -1,10 +1,34 @@
-import React from 'react';
+import React, { useState } from 'react';
 import { ActivityIndicator, Pressable, Text } from 'react-native';
 import { ProviderAttestModal } from './components/providerAttest/ProviderAttestModal';
+import { selectProviderFlow, } from './components/providerAttest/flowSelection';
 import { styles } from './components/providerAttest/styles';
-import { useProviderAttestFlow } from './components/providerAttest/useProviderAttestFlow';
+import { useTeelsProviderFlow } from './components/providerAttest/teels/useTeelsProviderFlow';
+import { useProviderAttestFlow, } from './components/providerAttest/useProviderAttestFlow';
+import { getSatyaRuntimeConfig } from './satyaConfig';
 export function SatyaProviderAttestButton(props) {
+    // Bind the runtime config once at mount (the init-before-mount contract),
+    // but recompute the flow selection from live props so a providerId/template
+    // switch cannot leave the button running a stale flow.
+    const [runtime] = useState(() => getSatyaRuntimeConfig());
+    const selection = selectProviderFlow({
+        providerId: props.providerId,
+        providerTemplateId: props.providerTemplate?.providerId,
+    }, runtime);
+    if (selection.type === 'teels') {
+        return <TeelsProviderFlowHost props={props} selection={selection}/>;
+    }
+    return <NativeProviderFlowHost props={props}/>;
+}
+function NativeProviderFlowHost({ props }) {
     const flow = useProviderAttestFlow(props);
+    return <ProviderAttestButtonView props={props} flow={flow}/>;
+}
+function TeelsProviderFlowHost({ props, selection, }) {
+    const flow = useTeelsProviderFlow(props, { selection });
+    return <ProviderAttestButtonView props={props} flow={flow}/>;
+}
+function ProviderAttestButtonView({ props, flow, }) {
     const isDisabled = props.disabled || flow.running || flow.modalVisible;
     const shouldRenderButton = props.renderButton ?? true;
     const WarmWebView = flow.ResolvedWebView;

package/build/SatyaProviderAttestButton.js.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaProviderAttestButton.js","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAY1F,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC;IACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC;IAEzC,OAAO,CACL,EACE;MAAA,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACpB,CAAC,SAAS,CACR,KAAK,CAAC,CAAC;gBACL,MAAM,CAAC,MAAM;gBACb,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC3C,UAAU,IAAI,MAAM,CAAC,cAAc;aACpC,CAAC,CACF,QAAQ,CAAC,CAAC,UAAU,CAAC,CACrB,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvB;UAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAG,CAAC,CAAC,CAAC,IAAI,CACzF;UAAA,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAC7B;YAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAC7D;UAAA,EAAE,IAAI,CACR;QAAA,EAAE,SAAS,CAAC,CACb,CAAC,CAAC,CAAC,IAAI,CACR;MAAA,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,CACpD,CAAC,WAAW,CACV,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC1B,aAAa,CAAC,MAAM,CACpB,iBAAiB,CAAC,CAAC,KAAK,CAAC,CACzB,2BAA2B,CAC3B,yBAAyB,CAAC,qBAAqB,EAC/C,CACH,CAAC,CAAC,CAAC,IAAI,CACR;MAAA,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAClC;IAAA,GAAG,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import React from 'react';\nimport { ActivityIndicator, Pressable, Text } from 'react-native';\n\nimport { ProviderAttestModal } from './components/providerAttest/ProviderAttestModal';\nimport { styles } from './components/providerAttest/styles';\nimport type { SatyaProviderAttestButtonProps } from './components/providerAttest/types';\nimport { useProviderAttestFlow } from './components/providerAttest/useProviderAttestFlow';\n\nexport type {\n  SatyaBackendVerifyResult,\n  SatyaProviderAttestButtonProps,\n  SatyaProviderAttestationResult,\n  SatyaProviderAttestPresentation,\n  SatyaProviderAttestTheme,\n  SatyaProviderFlowPhase,\n  SatyaProviderFlowProgress,\n} from './components/providerAttest/types';\n\nexport function SatyaProviderAttestButton(props: SatyaProviderAttestButtonProps) {\n  const flow = useProviderAttestFlow(props);\n  const isDisabled = props.disabled || flow.running || flow.modalVisible;\n  const shouldRenderButton = props.renderButton ?? true;\n  const WarmWebView = flow.ResolvedWebView;\n\n  return (\n    <>\n      {shouldRenderButton ? (\n        <Pressable\n          style={[\n            styles.button,\n            { backgroundColor: flow.theme.accentColor },\n            isDisabled && styles.buttonDisabled,\n          ]}\n          disabled={isDisabled}\n          onPress={flow.openFlow}>\n          {flow.running ? <ActivityIndicator color=\"#ffffff\" style={styles.buttonSpinner} /> : null}\n          <Text style={styles.buttonText}>\n            {flow.running ? 'Generating Attestation' : flow.buttonLabel}\n          </Text>\n        </Pressable>\n      ) : null}\n      {flow.prefetch && !flow.modalVisible && WarmWebView ? (\n        <WarmWebView\n          source={{ uri: 'about:blank' }}\n          style={styles.warmWebView}\n          pointerEvents=\"none\"\n          javaScriptEnabled={false}\n          accessibilityElementsHidden\n          importantForAccessibility=\"no-hide-descendants\"\n        />\n      ) : null}\n      <ProviderAttestModal flow={flow} />\n    </>\n  );\n}\n"]}
+{"version":3,"file":"SatyaProviderAttestButton.js","sourceRoot":"","sources":["../src/SatyaProviderAttestButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EACL,kBAAkB,GAEnB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AAE9F,OAAO,EACL,qBAAqB,GAEtB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAA2B,MAAM,eAAe,CAAC;AAc/E,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAqB,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAClC;QACE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE,UAAU;KACvD,EACD,OAAO,CACR,CAAC;IAEF,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,EAAG,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAG,CAAC;AAClD,CAAC;AAMD,SAAS,sBAAsB,CAAC,EAAE,KAAK,EAAyB;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAG,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,SAAS,GAGV;IACC,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAG,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAAC,EAChC,KAAK,EACL,IAAI,GAIL;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC;IACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC;IAEzC,OAAO,CACL,EACE;MAAA,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACpB,CAAC,SAAS,CACR,KAAK,CAAC,CAAC;gBACL,MAAM,CAAC,MAAM;gBACb,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC3C,UAAU,IAAI,MAAM,CAAC,cAAc;aACpC,CAAC,CACF,QAAQ,CAAC,CAAC,UAAU,CAAC,CACrB,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvB;UAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAG,CAAC,CAAC,CAAC,IAAI,CACzF;UAAA,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAC7B;YAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAC7D;UAAA,EAAE,IAAI,CACR;QAAA,EAAE,SAAS,CAAC,CACb,CAAC,CAAC,CAAC,IAAI,CACR;MAAA,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,CACpD,CAAC,WAAW,CACV,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC1B,aAAa,CAAC,MAAM,CACpB,iBAAiB,CAAC,CAAC,KAAK,CAAC,CACzB,2BAA2B,CAC3B,yBAAyB,CAAC,qBAAqB,EAC/C,CACH,CAAC,CAAC,CAAC,IAAI,CACR;MAAA,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAClC;IAAA,GAAG,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import React, { useState } from 'react';\nimport { ActivityIndicator, Pressable, Text } from 'react-native';\n\nimport { ProviderAttestModal } from './components/providerAttest/ProviderAttestModal';\nimport {\n  selectProviderFlow,\n  type SatyaProviderFlowSelection,\n} from './components/providerAttest/flowSelection';\nimport { styles } from './components/providerAttest/styles';\nimport { useTeelsProviderFlow } from './components/providerAttest/teels/useTeelsProviderFlow';\nimport type { SatyaProviderAttestButtonProps } from './components/providerAttest/types';\nimport {\n  useProviderAttestFlow,\n  type ProviderAttestFlow,\n} from './components/providerAttest/useProviderAttestFlow';\nimport { getSatyaRuntimeConfig, type SatyaRuntimeConfig } from './satyaConfig';\n\nexport type {\n  SatyaBackendVerifyResult,\n  SatyaProviderAttestButtonProps,\n  SatyaProviderAttestationResult,\n  SatyaProviderAttestPresentation,\n  SatyaProviderAttestTheme,\n  SatyaProviderFlowPhase,\n  SatyaProviderFlowProgress,\n  SatyaTeelsAttestation,\n  SatyaTeelsClaimData,\n} from './components/providerAttest/types';\n\nexport function SatyaProviderAttestButton(props: SatyaProviderAttestButtonProps) {\n  // Bind the runtime config once at mount (the init-before-mount contract),\n  // but recompute the flow selection from live props so a providerId/template\n  // switch cannot leave the button running a stale flow.\n  const [runtime] = useState<SatyaRuntimeConfig>(() => getSatyaRuntimeConfig());\n  const selection = selectProviderFlow(\n    {\n      providerId: props.providerId,\n      providerTemplateId: props.providerTemplate?.providerId,\n    },\n    runtime\n  );\n\n  if (selection.type === 'teels') {\n    return <TeelsProviderFlowHost props={props} selection={selection} />;\n  }\n  return <NativeProviderFlowHost props={props} />;\n}\n\ninterface ProviderFlowHostProps {\n  props: SatyaProviderAttestButtonProps;\n}\n\nfunction NativeProviderFlowHost({ props }: ProviderFlowHostProps) {\n  const flow = useProviderAttestFlow(props);\n  return <ProviderAttestButtonView props={props} flow={flow} />;\n}\n\nfunction TeelsProviderFlowHost({\n  props,\n  selection,\n}: ProviderFlowHostProps & {\n  selection: Extract<SatyaProviderFlowSelection, { type: 'teels' }>;\n}) {\n  const flow = useTeelsProviderFlow(props, { selection });\n  return <ProviderAttestButtonView props={props} flow={flow} />;\n}\n\nfunction ProviderAttestButtonView({\n  props,\n  flow,\n}: {\n  props: SatyaProviderAttestButtonProps;\n  flow: ProviderAttestFlow;\n}) {\n  const isDisabled = props.disabled || flow.running || flow.modalVisible;\n  const shouldRenderButton = props.renderButton ?? true;\n  const WarmWebView = flow.ResolvedWebView;\n\n  return (\n    <>\n      {shouldRenderButton ? (\n        <Pressable\n          style={[\n            styles.button,\n            { backgroundColor: flow.theme.accentColor },\n            isDisabled && styles.buttonDisabled,\n          ]}\n          disabled={isDisabled}\n          onPress={flow.openFlow}>\n          {flow.running ? <ActivityIndicator color=\"#ffffff\" style={styles.buttonSpinner} /> : null}\n          <Text style={styles.buttonText}>\n            {flow.running ? 'Generating Attestation' : flow.buttonLabel}\n          </Text>\n        </Pressable>\n      ) : null}\n      {flow.prefetch && !flow.modalVisible && WarmWebView ? (\n        <WarmWebView\n          source={{ uri: 'about:blank' }}\n          style={styles.warmWebView}\n          pointerEvents=\"none\"\n          javaScriptEnabled={false}\n          accessibilityElementsHidden\n          importantForAccessibility=\"no-hide-descendants\"\n        />\n      ) : null}\n      <ProviderAttestModal flow={flow} />\n    </>\n  );\n}\n"]}

package/build/components/providerAttest/ProviderAttestModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderAttestModal.d.ts","sourceRoot":"","sources":["../../../src/components/providerAttest/ProviderAttestModal.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAsC,MAAM,OAAO,CAAC;AA+B3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,UAAU,wBAAwB;IAChC,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,qBAMrE"}
+{"version":3,"file":"ProviderAttestModal.d.ts","sourceRoot":"","sources":["../../../src/components/providerAttest/ProviderAttestModal.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAsC,MAAM,OAAO,CAAC;AAqC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,UAAU,wBAAwB;IAChC,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,qBAMrE"}

package/build/components/providerAttest/ProviderAttestModal.js

@@ -2,7 +2,7 @@ import React, { useEffect, useRef, useState } from 'react';
 import { AccessibilityInfo, ActivityIndicator, Animated, Easing, Keyboard, LayoutAnimation, Modal, Platform, Pressable, StatusBar, StyleSheet, Text, useWindowDimensions, View, } from 'react-native';
 import { initialWindowMetrics, SafeAreaInsetsContext, SafeAreaProvider, } from 'react-native-safe-area-context';
 import { WEBVIEW_BOOTSTRAP_URL } from './constants';
-import { friendlyError, isRetryableError, preparingCopy, processingCopy } from './copy';
+import { friendlyError, friendlyTeelsError, isRetryableError, preparingCopy, processingCopy, } from './copy';
 import { managedPopupKey, managedPopupSource } from './popupRelay';
 import { defaultMobileBrowserUserAgent, providerLoginUrl } from './providerResolution';
 import { styles } from './styles';
@@ -143,7 +143,7 @@ function AndroidSheetHost({ flow }) {
     </Modal>);
 }
 function ProviderSheetContent({ flow, insets }) {
-    const { closeFlow, closeManagedPopup, contentReady, effectiveUserAgent, error, errorCode, errorRetryable, handleHardwareBack, handleMessage, handleNavigationStateChange, handleOpenWindow, handlePopupNavigationStateChange, handlePopupOpenWindow, handlePopupShouldStartLoadWithRequest, handleShouldStartLoadWithRequest, handleReload, isVerificationCovered, mainDocumentScriptReady, mainInjectedScript, managedPopup, markContentReady, markLoadEnd, markLoadStart, markPopupContentReady, maybeTriggerHtmlCapture, openFlow, phase, popupContentReady, popupDocumentScriptReady, popupHostRef, popupInjectedScript, popupRef, preparing, presentation, resolved, ResolvedWebView, secureConnection, secureHost, setBrowserChrome, setPopupChrome, theme, title, useNativePopups, webHostRef, webRef, webViewLoading, webViewProps, webViewUrl, returnToProvider, verificationPresentationStalled, } = flow;
+    const { closeFlow, closeManagedPopup, contentReady, effectiveUserAgent, error, errorCode, errorRetryable, handleHardwareBack, handleMessage, handleNavigationStateChange, handleOpenWindow, handlePopupNavigationStateChange, handlePopupOpenWindow, handlePopupShouldStartLoadWithRequest, handleShouldStartLoadWithRequest, handleReload, handleContentProcessDidTerminate, handleRenderProcessGone, handleWebViewError, handleWebViewHttpError, isTeelsFlow, isVerificationCovered, mainDocumentScriptReady, mainInjectedScript, managedPopup, markContentReady, markLoadEnd, markLoadStart, markPopupContentReady, maybeTriggerHtmlCapture, openFlow, phase, popupContentReady, popupDocumentScriptReady, popupHostRef, popupInjectedScript, popupRef, preparing, presentation, resolved, ResolvedWebView, secureConnection, secureHost, setBrowserChrome, setPopupChrome, theme, title, useNativePopups, webHostRef, webRef, webViewLoading, webViewProps, webViewUrl, returnToProvider, verificationPresentationStalled, } = flow;
     const useSheet = presentation === 'sheet';
     const [coverOpacity] = useState(() => new Animated.Value(1));
     const [popupCoverOpacity] = useState(() => new Animated.Value(1));
@@ -249,35 +249,45 @@ function ProviderSheetContent({ flow, insets }) {
         ]}/>
       </View>
       <View ref={webHostRef} style={[styles.webViewHost, { backgroundColor: theme.surfaceColor }]}>
-        {ResolvedWebView && resolved ? (<ResolvedWebView {...(webViewProps ?? {})} geolocationEnabled={resolved.template.requiresLocation === true} ref={webRef} source={{
+        {ResolvedWebView && resolved ? (<ResolvedWebView {...(webViewProps ?? {})} {...(isTeelsFlow
+            ? {
+                onContentProcessDidTerminate: handleContentProcessDidTerminate,
+                onRenderProcessGone: handleRenderProcessGone,
+                onError: handleWebViewError,
+                onHttpError: handleWebViewHttpError,
+            }
+            : {})} geolocationEnabled={resolved.template.requiresLocation === true} ref={webRef} source={{
                 uri: mainDocumentScriptReady
                     ? (webViewUrl ?? providerLoginUrl(resolved.template))
                     : WEBVIEW_BOOTSTRAP_URL,
             }} style={[styles.webView, webViewProps?.style]} accessibilityElementsHidden={providerContentConcealed} importantForAccessibility={providerContentConcealed ? 'no-hide-descendants' : 'auto'} javaScriptEnabled javaScriptCanOpenWindowsAutomatically domStorageEnabled sharedCookiesEnabled thirdPartyCookiesEnabled userAgent={effectiveUserAgent ?? defaultMobileBrowserUserAgent()} incognito={false} cacheEnabled setSupportMultipleWindows={useNativePopups} injectedJavaScriptBeforeContentLoaded={mainInjectedScript} injectedJavaScript={mainInjectedScript} injectedJavaScriptBeforeContentLoadedForMainFrameOnly={false} injectedJavaScriptForMainFrameOnly={false} onMessage={handleMessage} onOpenWindow={handleOpenWindow} onShouldStartLoadWithRequest={handleShouldStartLoadWithRequest} onNavigationStateChange={handleNavigationStateChange} onLoadStart={(event) => {
                 const nextChrome = readBrowserChromeState(event);
-                invokeWebViewCallback(webViewProps?.onLoadStart, event);
+                invokeMainWebViewCallback(webViewProps?.onLoadStart, event, isTeelsFlow, 'before');
                 if (!mainDocumentScriptReady && nextChrome.url === WEBVIEW_BOOTSTRAP_URL)
                     return;
-                markLoadStart();
+                markLoadStart(nextChrome.url);
                 setBrowserChrome((current) => ({
                     ...current,
                     ...nextChrome,
                     loading: true,
                 }));
+                invokeMainWebViewCallback(webViewProps?.onLoadStart, event, isTeelsFlow, 'after');
             }} onLoadEnd={(event) => {
                 const nextChrome = readBrowserChromeState(event);
-                invokeWebViewCallback(webViewProps?.onLoadEnd, event);
+                invokeMainWebViewCallback(webViewProps?.onLoadEnd, event, isTeelsFlow, 'before');
                 if (!mainDocumentScriptReady && nextChrome.url === WEBVIEW_BOOTSTRAP_URL)
                     return;
                 markContentReady();
-                markLoadEnd();
+                markLoadEnd(nextChrome.url);
                 setBrowserChrome((current) => ({
                     ...current,
                     ...nextChrome,
                     loading: false,
                 }));
                 webRef.current?.injectJavaScript?.(mainInjectedScript);
-                maybeTriggerHtmlCapture(nextChrome.url);
+                if (!isTeelsFlow)
+                    maybeTriggerHtmlCapture(nextChrome.url);
+                invokeMainWebViewCallback(webViewProps?.onLoadEnd, event, isTeelsFlow, 'after');
             }} originWhitelist={['http://*', 'https://*', 'about:*']}/>) : (<View style={styles.webViewFallback}>
             <Text style={styles.errorText}>react-native-webview is not available.</Text>
           </View>)}
@@ -376,10 +386,10 @@ function ProviderSheetContent({ flow, insets }) {
               <Text style={styles.errorIconGlyph}>!</Text>
             </View>
             <Text style={[styles.overlayTitle, { color: theme.onSurfaceColor }]}>
-              Could not verify your account
+              {isTeelsFlow ? 'Could not complete attestation' : 'Could not verify your account'}
             </Text>
             <Text style={[styles.overlaySubtitle, { color: theme.mutedColor }]}>
-              {friendlyError(error, errorCode)}
+              {isTeelsFlow ? friendlyTeelsError(error, errorCode) : friendlyError(error, errorCode)}
             </Text>
             {isRetryableError(errorCode, errorRetryable) ? (<Pressable style={[styles.primaryAction, { backgroundColor: theme.accentColor }]} onPress={openFlow}>
                 <Text style={styles.primaryActionText}>Try again</Text>
@@ -401,4 +411,18 @@ function ProviderSheetContent({ flow, insets }) {
       </View>
     </View>);
 }
+function invokeMainWebViewCallback(callback, event, isTeelsFlow, timing) {
+    if ((!isTeelsFlow && timing !== 'before') || (isTeelsFlow && timing !== 'after'))
+        return;
+    if (!isTeelsFlow) {
+        invokeWebViewCallback(callback, event);
+        return;
+    }
+    try {
+        invokeWebViewCallback(callback, event);
+    }
+    catch {
+        // Observational host callbacks cannot interrupt or settle the TeeLS flow.
+    }
+}
 //# sourceMappingURL=ProviderAttestModal.js.map