@burnt-labs/expo-satya-attest 3.9.0 → 3.10.0

package/CHANGELOG.md

@@ -1,9 +1,30 @@
 # Changelog
 
-## 3.9.0 - 2026-09-17
+## 3.10.0 - 2026-09-22
+
+- Keep monitoring ingestion unchanged: SDK-owned versioned `logData` metadata lets Devtool classify warnings and completion without new event types, service deployments, or database migrations.
+
+Release candidate; npm publication is required after review and release validation.
+
+### Added
 
-Release preparation; publication and completion of the native/device validation
-matrix are still pending.
+- TeeLS stage history in existing event logData, safe structured error causes and recovery guidance through
+  the hosted adapter, SDK callbacks and event ingestion. Wrong credentials,
+  declined challenges and cancellations are unsuccessful warning outcomes.
+- Existing `ATTESTATION_GENERATED` records hosted artifact receipt with
+  `flowOutcome: completed`, separately from independent `ATTESTATION_VERIFIED`.
+  The seven event types remain unchanged. Shared telemetry identifies flow type, schema
+  version, event sequence and elapsed attempt time. See
+  [TeeLS observability](./TEELS_OBSERVABILITY.md) for rollout sequencing and
+  required hosted Provider Registry injection updates.
+
+### Fixed
+
+- Hosted TeeLS consent dismissal ("Not now") records a cancellation warning
+  immediately instead of timing out. Modal teardown from success/error callbacks
+  preserves the original result without duplicate terminal events.
+
+## 3.9.0 - 2026-09-17
 
 ### Added
 
@@ -54,7 +75,7 @@ matrix are still pending.
   cleared. Keep `isolation: 'provider'` when turning automatic reset off.
 - Reset removes cookies, including persistent/HttpOnly cookies, but leaves local
   storage and caches intact. External-browser and remote hosted TeeLS sessions
-  are outside its scope. See [release gates](./PUBLISHING.md#provider-session-release-preparation).
+  are outside its scope. See [release gates](./PUBLISHING.md#release-preparation).
 
 ## 3.8.0 - 2026-09-14
 

package/PUBLISHING.md

@@ -10,12 +10,17 @@ very large native artifacts. The npm tarball still needs the native artifacts un
 package is redesigned to download or build them during install, which is not recommended
 for a plug-and-play Expo SDK.
 
-## Provider-session release preparation
-
-The next prepared minor release is **3.9.0**. It adds provider-isolated cookie
-stores and the public `clearProviderCookies` API. A version bump or passing
-package checks does not establish native device readiness: complete the gates
-below before tagging a stable release.
+## Release preparation
+
+The next prepared minor release is **3.10.0**. Version 3.9.0 is already published.
+This release adds TeeLS error context, warning outcomes and stage history in
+`logData`; the original seven event types are unchanged. It requires an npm
+publish after review and validation. Follow the [TeeLS rollout guide](./TEELS_OBSERVABILITY.md)
+for Devtool deployment, hosted adapter updates and the persisted-event device canary.
+No provider-monitor deployment or database migration is required; existing automated
+alerts retain their current counting behavior.
+A version bump or passing package checks does not establish native device readiness:
+complete the gates below before tagging a stable release.
 
 1. Keep `package.json`, both root version fields in `package-lock.json`,
    `ios/SatyaAttest.podspec`, Android `version` / `versionName`, generated SDK
@@ -48,7 +53,7 @@ Local cookie cleanup does not reset remote hosted TeeLS sessions.
 The package check requires both native session managers, the WebView snapshot
 helper, adapter script, Android keep rules and public JS/declarations. Host tests
 use synthetic stores and adapter fixtures; they are not substitutes for device
-cookie isolation tests. Until the app builds and device matrix pass, treat 3.9.0
+cookie isolation tests. Until the app builds and device matrix pass, treat 3.10.0
 as release preparation, not a validated stable release.
 
 ## TEE release requirements
@@ -256,7 +261,7 @@ internal/module_scripts/
 After the release gates pass and publication is authorized, use the consolidated
 `publish-expo-satya-attest.yml` workflow. A stable tag must match the committed
 package version and point to a commit on `main`; for this prepared release the
-package-specific tag is `expo-satya-attest-v3.9.0`. Creating/pushing that tag starts
+package-specific tag is `expo-satya-attest-v3.10.0`. Creating/pushing that tag starts
 publication. Manual workflow dispatch is a dry-run.
 
 The workflow builds native artifacts, runs the release checks, and publishes
@@ -274,13 +279,13 @@ Every push to `main` publishes a snapshot package to the public npm registry wit
 unique prerelease version:
 
 ```text
-3.9.1-snapshot.<run>.<attempt>.sha-<commit>
+3.10.1-snapshot.<run>.<attempt>.sha-<commit>
 ```
 
 The snapshot job (in `publish-expo-satya-attest.yml`) increments the package's patch base
-in CI before publishing. For example, if `package.json` is `3.9.0`, the snapshot version
-is based on `3.9.1`:
-`3.9.1-snapshot.<run>.<attempt>.sha-<commit>`. Snapshots are development builds and
+in CI before publishing. For example, if `package.json` is `3.10.0`, the snapshot version
+is based on `3.10.1`:
+`3.10.1-snapshot.<run>.<attempt>.sha-<commit>`. Snapshots are development builds and
 do not imply completion of the physical-device gates.
 
 Snapshots use the `snapshot` dist-tag so test apps do not need to know the generated

package/README.md

@@ -5,9 +5,11 @@ the Rust `satya-sdk` / `satya-ffi` pipeline for artifact construction and verifi
 policy, while Swift and Kotlin provide platform-specific WebView capture, native HTTPS
 replay, hardware-backed signing, and platform attestation evidence.
 
-**3.9.0 release preparation:** this source includes provider-isolated sessions and
-`clearProviderCookies`. The new version has not been published. See the
-[changelog](./CHANGELOG.md) and [release requirements](./PUBLISHING.md#provider-session-release-preparation).
+**3.10.0 release candidate:** this source adds TeeLS error context, warning outcomes
+and stage history within the existing seven logging event types. An npm publish
+is required after review and release validation. See the [changelog](./CHANGELOG.md),
+[release requirements](./PUBLISHING.md#release-preparation), and
+[TeeLS rollout guide](./TEELS_OBSERVABILITY.md).
 
 The SDK supports native app attestation, opt-in [TEE replay](./TEE_REPLAY.md),
 single-endpoint and composite proofs, provider-selective partial completion,
@@ -336,6 +338,9 @@ does not need frontend changes. See
 [Provider Config](./PROVIDER_CONFIG.md#hosted-teels-passthrough-provider-injection)
 for the adapter and device-validation contract.
 
+For stage events, warning outcomes, safe error details and deployment order, see
+[TeeLS observability](./TEELS_OBSERVABILITY.md).
+
 Only a non-null, JSON-safe attestation object can complete the flow. If provided,
 `claimData` is additionally forwarded as a second argument to `onTeelsComplete`.
 Success is returned only through `onTeelsComplete`; invalid/null data, hosted

package/TEELS_OBSERVABILITY.md

@@ -0,0 +1,128 @@
+# TeeLS flow observability
+
+TeeLS uses the shared SATYA event logger and session trace. `FAILED` remains an
+unsuccessful terminal. Confirmed wrong credentials, invalid/expired OTP, declined
+approval, cancellation and replaced attempts carry `failureClass: user_action`
+and `logLevel: warn`. Technical errors use `error`; unknown causes stay separately
+classified and count as unsuccessful in reliability metrics. HTTP 400/401/403
+alone never establishes incorrect credentials.
+
+## Events and safe context
+
+Every managed attempt emits `telemetrySchemaVersion: 1`, `flowType` (`teels`,
+`native_replay` or `tee_replay`), `attemptIndex`, monotonic `eventSequence`,
+`eventId`, and `totalElapsedMs`. The SDK session remains stable over user retries;
+the WebView bridge attempt ID changes. TeeLS's optional UUID is `teelsSessionId`,
+separate from the SDK session. An internal TeeLS auth retry is not a new SDK
+attempt and may repeat stages.
+
+The event enum remains fixed at its existing seven values. TeeLS uses
+`PROVIDER_INIT`, observed `LOGIN_COMPLETED`, `ATTESTATION_GENERATED`, and `FAILED`.
+Stage observations enrich `logData` rather than creating new event types.
+`teelsStage` is one of `initializing`, `navigating`, `entering_credentials`,
+`submitting`, `awaiting_challenge`, `challenge_submitted`, `logged_in`, `extracting`,
+or `attesting`. `LOGIN_COMPLETED` is emitted once when `logged_in` is observed.
+Duplicate consecutive stages are suppressed and at most 64 transitions are
+accepted per attempt. `teelsStageCount` counts accepted transitions;
+`teelsStageHistory` contains the most recent 12 as `stage:elapsedMs` pairs separated
+by commas, with elapsed times bounded to 24 hours. Only closed stage names and
+numbers are retained. Login, completion, failure, cancellation and supersession
+carry this history. A fresh SDK attempt resets it; internal retries retain it.
+Intermediate history is buffered until one of those events, so an app killed
+beforehand cannot upload it. Stage snapshots in Devtool count milestone/failure
+events, not unique stage reach or native replay/capture measurements.
+
+Successful hosted receipt emits one terminal `ATTESTATION_GENERATED` with
+`logData.flowType: "teels"`, `completionMode: "hosted"`, and
+`flowOutcome: "completed"`. It does **not** emit `ATTESTATION_VERIFIED` or assert
+`verifierDecision: ok`. Native generation remains nonterminal. Failed attempts
+carry `flowOutcome: "failed"`. The public `onTeelsComplete(attestation, claimData?)`
+callback is unchanged. Independent verification/relying-party acceptance must be
+reported by the component performing that work; receipt is not proof of acceptance.
+
+Failures retain the SATYA public code (for example `SATYA_TEELS_FLOW_FAILED`).
+Safe structured context adds `teelsErrorCode`, `teelsStage`, `teelsSessionId`,
+`httpStatus`, `failureClass`, canonical `errorMessage` and `recoveryAction`.
+The same detail is available in the host error's context. Only catalog codes,
+known stages, valid statuses and UUIDs cross the structured bridge boundary.
+Arbitrary provider text stays out of event ingestion; raw auth bodies,
+credentials, OTP values and challenge destinations are never telemetry fields.
+Legacy `login.auth failed: HTTP NNN (fields flagged: ...)` errors preserve only
+the status in telemetry, not the field names and not a guessed credential cause.
+
+## Existing ingestion contract
+
+The logger writes an SDK-owned `sdkTelemetry` first property in `logData` after
+sanitization. Its value is `v1|flow|stage|outcome|code`, with ASCII fields padded
+with spaces to widths 13, 20, 9 and 32. Only closed enums enter the header; callers
+cannot supply it. The code is the canonical TeeLS cause, `OTHER_TECHNICAL` for
+other named SDK failures, or empty when unavailable. Failure classification is
+derived from that code. Outcome is checked against the existing event: native
+`ATTESTATION_GENERATED` remains progress, and only explicit completed TeeLS receipt
+is a hosted terminal. The header is preserved first during size fallbacks, unless
+an application's custom logData budget is too small to hold it.
+
+Devtool reads this field from the existing blob 10 and validates the same version,
+widths, enums and event consistency in aggregate queries and event details.
+Malformed, scrubbed and legacy records stay unknown for flow/failure aggregates;
+old JSON can still supply error details. The bounded header retains a canonical
+reason even when later JSON is truncated. It is client analytics metadata, not
+security evidence. No additional event or ingestion dimension is required.
+
+## Hosted adapter compatibility
+
+Regenerate each hosted provider's injection using:
+
+```sh
+node scripts/generate-hosted-teels-provider-injection.js \
+  --origin https://YOUR-HOSTED-PAGE --json
+```
+
+Publish the generated injection through the normal Provider Registry version and
+policy-hash workflow. Existing registry records do not change when this SDK is
+released. Update all enabled TeeLS providers, including `ronde.teels.v1`,
+`perfect.fitness.teels.v1` and `satya.teels.v1`, using each record's actual origins.
+
+The adapter preserves one-argument `onSuccess(attestation)` and legacy
+`onSuccess(data, attestation)`, success event/snapshot paths, and `onError(string)`.
+New `onError(string, detail)` forwards the optional detail as the third argument
+to `bridge.fail`; old mobile bridges ignore it. `onStatus(progress)` is forwarded
+only when `bridge.progress` exists. Protocol version remains 1. Progress never
+sets the terminal latch. Origin/provider/attempt checks apply before accepting
+messages; oversize direct posts are ignored, while the SDK-owned bridge converts
+its own oversize terminal payload into a small correlated error.
+
+`onClose` before a terminal result forwards `USER_CANCELLED`, including the
+hosted consent screen's **Not now** action even with `dismissible: false`.
+Teardown during a success/error callback preserves that callback's result;
+later closes cannot emit another terminal event. Original host callbacks retain
+their receiver, arguments, return values and exceptions. Regenerate the hosted
+injection to enable this behavior; publishing the mobile SDK alone is insufficient.
+
+## Reporting and rollout
+
+These SDK changes ship in **3.10.0** and require publishing
+`@burnt-labs/expo-satya-attest@3.10.0` to npm, then adoption by consuming apps.
+Merging this PR alone does not make the stable package available.
+
+Deploy the Devtool reader update, then adopt the SATYA SDK update and publish
+compatible hosted injections alongside TeeLS server/web callbacks. Existing
+monitoring ingestion already preserves these seven event types, warning severity
+and safe logData; this release requires no monitoring-service change or database
+migration. Existing automated alerts keep their current failure-counting behavior. This change adds no native API, but does not waive
+the release/device validation required by the SDK's other pending changes.
+
+Devtool displays wrong credentials/cancellation as **Failed · warning** in yellow.
+Completion includes all unsuccessful attempts. Technical reliability excludes
+only confirmed user-action warnings; unknown failures remain in its denominator.
+Both use sample-weighted terminal event counts, not exact unique-attempt conversion.
+Source monitor snapshots and EarnOS worker analytics have independent windows and
+denominators. Existing EarnOS session events do not automatically gain SDK fields.
+
+Canary a controlled wrong-password attempt, cancellation, a technical error and
+retry→success on supported iOS/Android runtimes. Verify persisted AE rows and the
+Devtool trace (code, stage, safe reason, color, one terminal), not merely HTTP 202.
+The ingestion endpoint can also accept but decline an unregistered provider.
+Check older SDKs with the new adapter and newer SDKs with cached older pages.
+Rollback emitters/hosted injection versions if needed; leave the compatible
+Devtool reader in place. Old unknown records must not be relabeled as bad credentials.

package/android/build.gradle

@@ -4,14 +4,14 @@ plugins {
 }
 
 group = 'expo.modules.satyaattest'
-version = '3.9.0'
+version = '3.10.0'
 
 android {
   namespace "expo.modules.satyaattest"
   defaultConfig {
     consumerProguardFiles 'consumer-rules.pro'
     versionCode 1
-    versionName "3.9.0"
+    versionName "3.10.0"
     // StrongBox key attestation needs API 28+; basic Keystore attestation API 24+.
     minSdkVersion 24
   }

package/build/components/providerAttest/copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy.d.ts","sourceRoot":"","sources":["../../../src/components/providerAttest/copy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAmCtD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAI1F;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAeA;AAED,wBAAgB,aAAa,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA+B3E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAchF"}
+{"version":3,"file":"copy.d.ts","sourceRoot":"","sources":["../../../src/components/providerAttest/copy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAoCtD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAI1F;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAeA;AAED,wBAAgB,aAAa,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA+B3E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAiBhF"}

package/build/components/providerAttest/copy.js

@@ -1,3 +1,4 @@
+import { TEELS_ERROR_INFO } from '../../teelsTelemetry';
 import { SatyaErrorCode } from '../../types/error.types';
 /**
  * Gate refusals are permanent for this build+provider: the app is not
@@ -102,6 +103,10 @@ export function friendlyTeelsError(message, code) {
         return 'The TeeLS flow timed out. Please try again.';
     }
     if (code === SatyaErrorCode.TEELS_FLOW_FAILED) {
+        for (const info of Object.values(TEELS_ERROR_INFO)) {
+            if (message.endsWith(': ' + info.message))
+                return info.message + ' ' + info.recoveryAction;
+        }
         return 'The TeeLS flow could not complete. Please try again.';
     }
     return friendlyError(message, code);

package/build/components/providerAttest/copy.js.map

@@ -1 +1 @@
-{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../../src/components/providerAttest/copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,eAAe,GAA2B;IAC9C,CAAC,cAAc,CAAC,sBAAsB,CAAC,EACrC,yFAAyF;IAC3F,CAAC,cAAc,CAAC,kBAAkB,CAAC,EACjC,qEAAqE;IACvE,CAAC,cAAc,CAAC,YAAY,CAAC,EAC3B,2EAA2E;IAC7E,CAAC,cAAc,CAAC,eAAe,CAAC,EAC9B,qEAAqE;IACvE,CAAC,cAAc,CAAC,oBAAoB,CAAC,EACnC,2DAA2D;IAC7D,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAC1C,yFAAyF;CAC5F,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EACxC,+EAA+E;IACjF,CAAC,cAAc,CAAC,uBAAuB,CAAC,EACtC,+EAA+E;CAClF,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAoB,EAAE,SAA0B;IAC/E,IAAI,OAAO,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA6B;IAC1D,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,2BAA2B,CAAC;IAClE,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,oCAAoC,CAAC;IAC1E,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAA+C;IAIvE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EACN,kGAAkG;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,iDAAiD;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAqB;IACjD,OAAO,YAAY,CAAC,CAAC,CAAC,iBAAiB,YAAY,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAoB;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,sBAAsB;IACtB,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,OAAO,wEAAwE,CAAC;IAClF,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,OAAO,4FAA4F,CAAC;IACtG,CAAC;IACD,OAAO,yCAAyC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,IAAoB;IACtE,IAAI,IAAI,KAAK,cAAc,CAAC,yBAAyB,EAAE,CAAC;QACtD,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,oBAAoB,EAAE,CAAC;QACjD,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,kBAAkB,EAAE,CAAC;QAC/C,OAAO,6CAA6C,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import type { SatyaProviderFlowPhase } from './types';\nimport { SatyaErrorCode } from '../../types/error.types';\n\n/**\n * Gate refusals are permanent for this build+provider: the app is not\n * registered/approved, or the provider is not granted to it. Retrying cannot\n * help, so the copy must say what is wrong and the UI must not offer \"Try\n * again\" (see isRetryableError).\n */\nconst GATE_ERROR_COPY: Record<string, string> = {\n  [SatyaErrorCode.PROVIDER_ACCESS_DENIED]:\n    'This provider is not enabled for this app yet. Contact the app owner to request access.',\n  [SatyaErrorCode.APP_NOT_REGISTERED]:\n    'This app is not registered for verification. Contact the app owner.',\n  [SatyaErrorCode.APP_DISABLED]:\n    'Verification is turned off for this app right now. Contact the app owner.',\n  [SatyaErrorCode.APP_ID_REQUIRED]:\n    'This app is not set up for verification yet. Contact the app owner.',\n  [SatyaErrorCode.APP_BINDING_MISMATCH]:\n    'This app build cannot be verified. Contact the app owner.',\n  [SatyaErrorCode.APP_PLATFORM_NOT_CONFIGURED]:\n    'This device platform is not set up for verification in this app. Contact the app owner.',\n};\n\n/**\n * Provider/template configuration problems: not the user's fault and not\n * fixable by retrying — same treatment as gate refusals.\n */\nconst CONFIG_ERROR_COPY: Record<string, string> = {\n  [SatyaErrorCode.PROVIDER_TEMPLATE_INVALID]:\n    'This provider is not set up correctly in this app yet. Contact the app owner.',\n  [SatyaErrorCode.PROVIDER_POLICY_INVALID]:\n    'This provider is not set up correctly in this app yet. Contact the app owner.',\n};\n\n/** Prefer the verifier's explicit answer; otherwise classify local SDK codes. */\nexport function isRetryableError(code?: string | null, retryable?: boolean | null): boolean {\n  if (typeof retryable === 'boolean') return retryable;\n  if (!code) return true;\n  return !(code in GATE_ERROR_COPY) && !(code in CONFIG_ERROR_COPY);\n}\n\nexport function processingCopy(phase: SatyaProviderFlowPhase): string {\n  if (phase === 'backendVerify') return 'Finishing verification...';\n  if (phase === 'nativeReplay') return 'Securely verifying your account...';\n  return 'Verifying your account...';\n}\n\n/**\n * Copy for the cover, which is shown from the moment a login is submitted.\n * The pending tier deliberately does not claim verification has started — at\n * that point the credentials have only been sent.\n */\nexport function coverCopy(options: { pending: boolean; stalled: boolean }): {\n  title: string;\n  subtitle: string;\n} {\n  if (options.stalled) {\n    return {\n      title: 'Still verifying...',\n      subtitle:\n        'This is taking longer than expected. You can return to the provider without ending verification.',\n    };\n  }\n  if (options.pending) {\n    return { title: 'Signing you in...', subtitle: 'Just a moment.' };\n  }\n  return {\n    title: 'Verifying your account...',\n    subtitle: 'Keep this screen open - it only takes a moment.',\n  };\n}\n\nexport function preparingCopy(providerName?: string): string {\n  return providerName ? `Connecting to ${providerName}...` : 'Connecting securely...';\n}\n\nexport function friendlyError(message: string, code?: string | null): string {\n  // Prefer the typed code: gate refusals and configuration errors have\n  // precise, actionable copy and must never fall through to the generic\n  // \"try again\" string.\n  if (code && GATE_ERROR_COPY[code]) return GATE_ERROR_COPY[code];\n  if (code && CONFIG_ERROR_COPY[code]) return CONFIG_ERROR_COPY[code];\n  const m = (message || '').toLowerCase();\n  if (m.includes('location permission') || m.includes('location access')) {\n    return 'Location access is required for this provider. Allow it and try again.';\n  }\n  if (\n    m.includes('403') ||\n    m.includes('forbidden') ||\n    m.includes('cloudflare') ||\n    m.includes('bot')\n  ) {\n    return 'This provider is blocking automated verification right now. Please try again later.';\n  }\n  if (m.includes('network') || m.includes('timeout') || m.includes('timed out')) {\n    return 'There was a network problem. Check your connection and try again.';\n  }\n  if (m.includes('request failed from') || m.includes('policy fetch')) {\n    return 'Could not reach the verification service. Check your connection and try again.';\n  }\n  if (m.includes('pin') || m.includes('certificate') || m.includes('tls') || m.includes('secure')) {\n    return 'We could not establish a secure connection to this provider. Please try again.';\n  }\n  if (m.includes('claim') || m.includes('reveal') || m.includes('match')) {\n    return 'We could not read the expected details. Make sure you are fully signed in, then try again.';\n  }\n  return 'Something went wrong. Please try again.';\n}\n\nexport function friendlyTeelsError(message: string, code?: string | null): string {\n  if (code === SatyaErrorCode.TEELS_ATTESTATION_MISSING) {\n    return 'The provider completed without returning a TeeLS attestation.';\n  }\n  if (code === SatyaErrorCode.TEELS_BRIDGE_INVALID) {\n    return 'The provider returned an invalid TeeLS attestation.';\n  }\n  if (code === SatyaErrorCode.TEELS_FLOW_TIMEOUT) {\n    return 'The TeeLS flow timed out. Please try again.';\n  }\n  if (code === SatyaErrorCode.TEELS_FLOW_FAILED) {\n    return 'The TeeLS flow could not complete. Please try again.';\n  }\n  return friendlyError(message, code);\n}\n"]}
+{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../../src/components/providerAttest/copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,eAAe,GAA2B;IAC9C,CAAC,cAAc,CAAC,sBAAsB,CAAC,EACrC,yFAAyF;IAC3F,CAAC,cAAc,CAAC,kBAAkB,CAAC,EACjC,qEAAqE;IACvE,CAAC,cAAc,CAAC,YAAY,CAAC,EAC3B,2EAA2E;IAC7E,CAAC,cAAc,CAAC,eAAe,CAAC,EAC9B,qEAAqE;IACvE,CAAC,cAAc,CAAC,oBAAoB,CAAC,EACnC,2DAA2D;IAC7D,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAC1C,yFAAyF;CAC5F,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EACxC,+EAA+E;IACjF,CAAC,cAAc,CAAC,uBAAuB,CAAC,EACtC,+EAA+E;CAClF,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAoB,EAAE,SAA0B;IAC/E,IAAI,OAAO,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA6B;IAC1D,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,2BAA2B,CAAC;IAClE,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,oCAAoC,CAAC;IAC1E,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAA+C;IAIvE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EACN,kGAAkG;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,iDAAiD;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAqB;IACjD,OAAO,YAAY,CAAC,CAAC,CAAC,iBAAiB,YAAY,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAoB;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,sBAAsB;IACtB,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,OAAO,wEAAwE,CAAC;IAClF,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,OAAO,4FAA4F,CAAC;IACtG,CAAC;IACD,OAAO,yCAAyC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,IAAoB;IACtE,IAAI,IAAI,KAAK,cAAc,CAAC,yBAAyB,EAAE,CAAC;QACtD,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,oBAAoB,EAAE,CAAC;QACjD,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,kBAAkB,EAAE,CAAC;QAC/C,OAAO,6CAA6C,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAC7F,CAAC;QACD,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import type { SatyaProviderFlowPhase } from './types';\nimport { TEELS_ERROR_INFO } from '../../teelsTelemetry';\nimport { SatyaErrorCode } from '../../types/error.types';\n\n/**\n * Gate refusals are permanent for this build+provider: the app is not\n * registered/approved, or the provider is not granted to it. Retrying cannot\n * help, so the copy must say what is wrong and the UI must not offer \"Try\n * again\" (see isRetryableError).\n */\nconst GATE_ERROR_COPY: Record<string, string> = {\n  [SatyaErrorCode.PROVIDER_ACCESS_DENIED]:\n    'This provider is not enabled for this app yet. Contact the app owner to request access.',\n  [SatyaErrorCode.APP_NOT_REGISTERED]:\n    'This app is not registered for verification. Contact the app owner.',\n  [SatyaErrorCode.APP_DISABLED]:\n    'Verification is turned off for this app right now. Contact the app owner.',\n  [SatyaErrorCode.APP_ID_REQUIRED]:\n    'This app is not set up for verification yet. Contact the app owner.',\n  [SatyaErrorCode.APP_BINDING_MISMATCH]:\n    'This app build cannot be verified. Contact the app owner.',\n  [SatyaErrorCode.APP_PLATFORM_NOT_CONFIGURED]:\n    'This device platform is not set up for verification in this app. Contact the app owner.',\n};\n\n/**\n * Provider/template configuration problems: not the user's fault and not\n * fixable by retrying — same treatment as gate refusals.\n */\nconst CONFIG_ERROR_COPY: Record<string, string> = {\n  [SatyaErrorCode.PROVIDER_TEMPLATE_INVALID]:\n    'This provider is not set up correctly in this app yet. Contact the app owner.',\n  [SatyaErrorCode.PROVIDER_POLICY_INVALID]:\n    'This provider is not set up correctly in this app yet. Contact the app owner.',\n};\n\n/** Prefer the verifier's explicit answer; otherwise classify local SDK codes. */\nexport function isRetryableError(code?: string | null, retryable?: boolean | null): boolean {\n  if (typeof retryable === 'boolean') return retryable;\n  if (!code) return true;\n  return !(code in GATE_ERROR_COPY) && !(code in CONFIG_ERROR_COPY);\n}\n\nexport function processingCopy(phase: SatyaProviderFlowPhase): string {\n  if (phase === 'backendVerify') return 'Finishing verification...';\n  if (phase === 'nativeReplay') return 'Securely verifying your account...';\n  return 'Verifying your account...';\n}\n\n/**\n * Copy for the cover, which is shown from the moment a login is submitted.\n * The pending tier deliberately does not claim verification has started — at\n * that point the credentials have only been sent.\n */\nexport function coverCopy(options: { pending: boolean; stalled: boolean }): {\n  title: string;\n  subtitle: string;\n} {\n  if (options.stalled) {\n    return {\n      title: 'Still verifying...',\n      subtitle:\n        'This is taking longer than expected. You can return to the provider without ending verification.',\n    };\n  }\n  if (options.pending) {\n    return { title: 'Signing you in...', subtitle: 'Just a moment.' };\n  }\n  return {\n    title: 'Verifying your account...',\n    subtitle: 'Keep this screen open - it only takes a moment.',\n  };\n}\n\nexport function preparingCopy(providerName?: string): string {\n  return providerName ? `Connecting to ${providerName}...` : 'Connecting securely...';\n}\n\nexport function friendlyError(message: string, code?: string | null): string {\n  // Prefer the typed code: gate refusals and configuration errors have\n  // precise, actionable copy and must never fall through to the generic\n  // \"try again\" string.\n  if (code && GATE_ERROR_COPY[code]) return GATE_ERROR_COPY[code];\n  if (code && CONFIG_ERROR_COPY[code]) return CONFIG_ERROR_COPY[code];\n  const m = (message || '').toLowerCase();\n  if (m.includes('location permission') || m.includes('location access')) {\n    return 'Location access is required for this provider. Allow it and try again.';\n  }\n  if (\n    m.includes('403') ||\n    m.includes('forbidden') ||\n    m.includes('cloudflare') ||\n    m.includes('bot')\n  ) {\n    return 'This provider is blocking automated verification right now. Please try again later.';\n  }\n  if (m.includes('network') || m.includes('timeout') || m.includes('timed out')) {\n    return 'There was a network problem. Check your connection and try again.';\n  }\n  if (m.includes('request failed from') || m.includes('policy fetch')) {\n    return 'Could not reach the verification service. Check your connection and try again.';\n  }\n  if (m.includes('pin') || m.includes('certificate') || m.includes('tls') || m.includes('secure')) {\n    return 'We could not establish a secure connection to this provider. Please try again.';\n  }\n  if (m.includes('claim') || m.includes('reveal') || m.includes('match')) {\n    return 'We could not read the expected details. Make sure you are fully signed in, then try again.';\n  }\n  return 'Something went wrong. Please try again.';\n}\n\nexport function friendlyTeelsError(message: string, code?: string | null): string {\n  if (code === SatyaErrorCode.TEELS_ATTESTATION_MISSING) {\n    return 'The provider completed without returning a TeeLS attestation.';\n  }\n  if (code === SatyaErrorCode.TEELS_BRIDGE_INVALID) {\n    return 'The provider returned an invalid TeeLS attestation.';\n  }\n  if (code === SatyaErrorCode.TEELS_FLOW_TIMEOUT) {\n    return 'The TeeLS flow timed out. Please try again.';\n  }\n  if (code === SatyaErrorCode.TEELS_FLOW_FAILED) {\n    for (const info of Object.values(TEELS_ERROR_INFO)) {\n      if (message.endsWith(': ' + info.message)) return info.message + ' ' + info.recoveryAction;\n    }\n    return 'The TeeLS flow could not complete. Please try again.';\n  }\n  return friendlyError(message, code);\n}\n"]}

package/build/components/providerAttest/teels/teelsFailure.d.ts

@@ -1,5 +1,6 @@
 import type { TeelsBridgeMessageResult } from './teelsProtocol';
 import type { SdkEventLogData } from '../../../sdkEventLog';
+import { type TeelsErrorDetail } from '../../../teelsTelemetry';
 import { type SatyaError } from '../../../types/error.types';
 type TeelsBridgeErrorResult = Extract<TeelsBridgeMessageResult, {
     kind: 'error';
@@ -7,6 +8,7 @@ type TeelsBridgeErrorResult = Extract<TeelsBridgeMessageResult, {
 export interface TeelsFailureTelemetry {
     errorMessage: string;
     httpStatus?: number;
+    detail?: TeelsErrorDetail;
 }
 export interface TeelsBridgeFailure {
     error: SatyaError;

package/build/components/providerAttest/teels/teelsFailure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teelsFailure.d.ts","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAoC,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE/F,KAAK,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,CAW3F;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,EAC3B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,eAAe,CAcjB"}
+{"version":3,"file":"teelsFailure.d.ts","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsFailure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAoC,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE/F,KAAK,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,CA+B3F;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,EAC3B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,eAAe,CAuBjB"}

package/build/components/providerAttest/teels/teelsFailure.js

@@ -1,13 +1,30 @@
+import { TEELS_ERROR_INFO } from '../../../teelsTelemetry';
 import { SATYA_ERROR_MESSAGES, satyaError } from '../../../types/error.types';
 export function createTeelsBridgeFailure(result) {
     const baseMessage = SATYA_ERROR_MESSAGES[result.code];
+    const detail = result.errorDetail;
+    const info = detail ? TEELS_ERROR_INFO[detail.code] : undefined;
     return {
-        error: satyaError(result.code, result.detail),
+        error: satyaError(result.code, info?.message ?? result.detail, detail
+            ? {
+                teelsErrorCode: detail.code,
+                teelsStage: detail.stage,
+                httpStatus: detail.httpStatus,
+                teelsSessionId: detail.sessionId,
+                failureClass: info?.failureClass,
+                recoveryAction: info?.recoveryAction,
+            }
+            : undefined),
         telemetry: {
-            errorMessage: result.telemetryDetail
-                ? baseMessage + ': ' + result.telemetryDetail
-                : baseMessage,
-            ...(typeof result.httpStatus === 'number' ? { httpStatus: result.httpStatus } : {}),
+            ...(detail ? { detail } : {}),
+            errorMessage: info
+                ? info.message
+                : result.telemetryDetail
+                    ? baseMessage + ': ' + result.telemetryDetail
+                    : baseMessage,
+            ...(typeof (detail?.httpStatus ?? result.httpStatus) === 'number'
+                ? { httpStatus: detail?.httpStatus ?? result.httpStatus }
+                : {}),
         },
     };
 }
@@ -23,6 +40,15 @@ export function buildTeelsFailureLogData(input, providerId, funnelStage) {
         funnelStage,
         retryable: typeof context.retryable === 'boolean' ? context.retryable : undefined,
         httpStatus: telemetry?.httpStatus,
+        ...(telemetry?.detail
+            ? {
+                teelsErrorCode: telemetry.detail.code,
+                ...(telemetry.detail.stage ? { teelsStage: telemetry.detail.stage } : {}),
+                ...(telemetry.detail.sessionId ? { teelsSessionId: telemetry.detail.sessionId } : {}),
+                failureClass: TEELS_ERROR_INFO[telemetry.detail.code].failureClass,
+                recoveryAction: TEELS_ERROR_INFO[telemetry.detail.code].recoveryAction,
+            }
+            : {}),
         errorId: error.errorId,
     };
 }

package/build/components/providerAttest/teels/teelsFailure.js.map

@@ -1 +1 @@
-{"version":3,"file":"teelsFailure.js","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsFailure.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAmB,MAAM,4BAA4B,CAAC;AAkB/F,MAAM,UAAU,wBAAwB,CAAC,MAA8B;IACrE,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,SAAS,EAAE;YACT,YAAY,EAAE,MAAM,CAAC,eAAe;gBAClC,CAAC,CAAC,WAAW,GAAG,IAAI,GAAG,MAAM,CAAC,eAAe;gBAC7C,CAAC,CAAC,WAAW;YACf,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAA2B,EAC3B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IACjE,OAAO;QACL,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;QAChE,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,WAAW;QACX,SAAS,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACjF,UAAU,EAAE,SAAS,EAAE,UAAU;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { TeelsBridgeMessageResult } from './teelsProtocol';\nimport type { SdkEventLogData } from '../../../sdkEventLog';\nimport { SATYA_ERROR_MESSAGES, satyaError, type SatyaError } from '../../../types/error.types';\n\ntype TeelsBridgeErrorResult = Extract<TeelsBridgeMessageResult, { kind: 'error' }>;\n\nexport interface TeelsFailureTelemetry {\n  errorMessage: string;\n  httpStatus?: number;\n}\n\nexport interface TeelsBridgeFailure {\n  error: SatyaError;\n  telemetry: TeelsFailureTelemetry;\n}\n\nexport type TeelsFailureLogInput =\n  | { source: 'sdk'; error: SatyaError }\n  | { source: 'bridge'; failure: TeelsBridgeFailure };\n\nexport function createTeelsBridgeFailure(result: TeelsBridgeErrorResult): TeelsBridgeFailure {\n  const baseMessage = SATYA_ERROR_MESSAGES[result.code];\n  return {\n    error: satyaError(result.code, result.detail),\n    telemetry: {\n      errorMessage: result.telemetryDetail\n        ? baseMessage + ': ' + result.telemetryDetail\n        : baseMessage,\n      ...(typeof result.httpStatus === 'number' ? { httpStatus: result.httpStatus } : {}),\n    },\n  };\n}\n\nexport function buildTeelsFailureLogData(\n  input: TeelsFailureLogInput,\n  providerId: string,\n  funnelStage: string\n): SdkEventLogData {\n  const error = input.source === 'bridge' ? input.failure.error : input.error;\n  const telemetry = input.source === 'bridge' ? input.failure.telemetry : undefined;\n  const context = (error.context ?? {}) as Record<string, unknown>;\n  return {\n    providerId,\n    errorCode: error.code,\n    errorMessage: telemetry ? telemetry.errorMessage : error.message,\n    sdkStage: error.stage,\n    funnelStage,\n    retryable: typeof context.retryable === 'boolean' ? context.retryable : undefined,\n    httpStatus: telemetry?.httpStatus,\n    errorId: error.errorId,\n  };\n}\n"]}
+{"version":3,"file":"teelsFailure.js","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsFailure.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAmB,MAAM,4BAA4B,CAAC;AAmB/F,MAAM,UAAU,wBAAwB,CAAC,MAA8B;IACrE,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO;QACL,KAAK,EAAE,UAAU,CACf,MAAM,CAAC,IAAI,EACX,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAC9B,MAAM;YACJ,CAAC,CAAC;gBACE,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,UAAU,EAAE,MAAM,CAAC,KAAK;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,SAAS;gBAChC,YAAY,EAAE,IAAI,EAAE,YAAY;gBAChC,cAAc,EAAE,IAAI,EAAE,cAAc;aACrC;YACH,CAAC,CAAC,SAAS,CACd;QACD,SAAS,EAAE;YACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY,EAAE,IAAI;gBAChB,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,MAAM,CAAC,eAAe;oBACtB,CAAC,CAAC,WAAW,GAAG,IAAI,GAAG,MAAM,CAAC,eAAe;oBAC7C,CAAC,CAAC,WAAW;YACjB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;gBAC/D,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAA2B,EAC3B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IACjE,OAAO;QACL,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;QAChE,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,WAAW;QACX,SAAS,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACjF,UAAU,EAAE,SAAS,EAAE,UAAU;QACjC,GAAG,CAAC,SAAS,EAAE,MAAM;YACnB,CAAC,CAAC;gBACE,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBACrC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;gBAClE,cAAc,EAAE,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc;aACvE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import type { TeelsBridgeMessageResult } from './teelsProtocol';\nimport type { SdkEventLogData } from '../../../sdkEventLog';\nimport { TEELS_ERROR_INFO, type TeelsErrorDetail } from '../../../teelsTelemetry';\nimport { SATYA_ERROR_MESSAGES, satyaError, type SatyaError } from '../../../types/error.types';\n\ntype TeelsBridgeErrorResult = Extract<TeelsBridgeMessageResult, { kind: 'error' }>;\n\nexport interface TeelsFailureTelemetry {\n  errorMessage: string;\n  httpStatus?: number;\n  detail?: TeelsErrorDetail;\n}\n\nexport interface TeelsBridgeFailure {\n  error: SatyaError;\n  telemetry: TeelsFailureTelemetry;\n}\n\nexport type TeelsFailureLogInput =\n  | { source: 'sdk'; error: SatyaError }\n  | { source: 'bridge'; failure: TeelsBridgeFailure };\n\nexport function createTeelsBridgeFailure(result: TeelsBridgeErrorResult): TeelsBridgeFailure {\n  const baseMessage = SATYA_ERROR_MESSAGES[result.code];\n  const detail = result.errorDetail;\n  const info = detail ? TEELS_ERROR_INFO[detail.code] : undefined;\n  return {\n    error: satyaError(\n      result.code,\n      info?.message ?? result.detail,\n      detail\n        ? {\n            teelsErrorCode: detail.code,\n            teelsStage: detail.stage,\n            httpStatus: detail.httpStatus,\n            teelsSessionId: detail.sessionId,\n            failureClass: info?.failureClass,\n            recoveryAction: info?.recoveryAction,\n          }\n        : undefined\n    ),\n    telemetry: {\n      ...(detail ? { detail } : {}),\n      errorMessage: info\n        ? info.message\n        : result.telemetryDetail\n          ? baseMessage + ': ' + result.telemetryDetail\n          : baseMessage,\n      ...(typeof (detail?.httpStatus ?? result.httpStatus) === 'number'\n        ? { httpStatus: detail?.httpStatus ?? result.httpStatus }\n        : {}),\n    },\n  };\n}\n\nexport function buildTeelsFailureLogData(\n  input: TeelsFailureLogInput,\n  providerId: string,\n  funnelStage: string\n): SdkEventLogData {\n  const error = input.source === 'bridge' ? input.failure.error : input.error;\n  const telemetry = input.source === 'bridge' ? input.failure.telemetry : undefined;\n  const context = (error.context ?? {}) as Record<string, unknown>;\n  return {\n    providerId,\n    errorCode: error.code,\n    errorMessage: telemetry ? telemetry.errorMessage : error.message,\n    sdkStage: error.stage,\n    funnelStage,\n    retryable: typeof context.retryable === 'boolean' ? context.retryable : undefined,\n    httpStatus: telemetry?.httpStatus,\n    ...(telemetry?.detail\n      ? {\n          teelsErrorCode: telemetry.detail.code,\n          ...(telemetry.detail.stage ? { teelsStage: telemetry.detail.stage } : {}),\n          ...(telemetry.detail.sessionId ? { teelsSessionId: telemetry.detail.sessionId } : {}),\n          failureClass: TEELS_ERROR_INFO[telemetry.detail.code].failureClass,\n          recoveryAction: TEELS_ERROR_INFO[telemetry.detail.code].recoveryAction,\n        }\n      : {}),\n    errorId: error.errorId,\n  };\n}\n"]}

package/build/components/providerAttest/teels/teelsProtocol.d.ts

@@ -1,3 +1,4 @@
+import { type TeelsErrorDetail, type TeelsProgress } from '../../../teelsTelemetry';
 import type { SatyaProviderInjection } from '../../../types';
 import { type SatyaErrorCodeValue } from '../../../types/error.types';
 import type { SatyaTeelsAttestation, SatyaTeelsClaimData } from '../types';
@@ -20,6 +21,9 @@ export interface TeelsBridgeCompletePayload {
 }
 export type TeelsBridgeMessageResult = {
     kind: 'ignore';
+} | {
+    kind: 'progress';
+    progress: TeelsProgress;
 } | {
     kind: 'complete';
     payload: TeelsBridgeCompletePayload;
@@ -28,6 +32,7 @@ export type TeelsBridgeMessageResult = {
     code: SatyaErrorCodeValue;
     detail?: string;
     telemetryDetail?: string;
+    errorDetail?: TeelsErrorDetail;
     httpStatus?: number;
 };
 export declare function createTeelsAttemptId(cryptoSource?: Pick<Crypto, 'getRandomValues' | 'randomUUID'> | null | undefined): string;

package/build/components/providerAttest/teels/teelsProtocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teelsProtocol.d.ts","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsProtocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE3E,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAC/C,eAAO,MAAM,8BAA8B,QAAa,CAAC;AACzD,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAMhD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,0BAA0B,CAAA;CAAE,GACzD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,YAAY,GACR,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY,CAAC,GAC9C,IAAI,GACJ,SAA6B,GAChC,MAAM,CAaR;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,sBAAsB,CAAC;CAC3C,GAAG,MAAM,CAwIT;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,CAsE1B;AAmDD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAgCtF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWpD;AAYD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}
+{"version":3,"file":"teelsProtocol.d.ts","sourceRoot":"","sources":["../../../../src/components/providerAttest/teels/teelsProtocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE3E,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAC/C,eAAO,MAAM,8BAA8B,QAAa,CAAC;AACzD,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAOhD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,0BAA0B,CAAA;CAAE,GACzD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,YAAY,GACR,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY,CAAC,GAC9C,IAAI,GACJ,SAA6B,GAChC,MAAM,CAaR;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,sBAAsB,CAAC;CAC3C,GAAG,MAAM,CAoJT;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,CAwF1B;AAsDD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAgCtF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWpD;AAYD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/build/components/providerAttest/teels/teelsProtocol.js

@@ -1,3 +1,4 @@
+import { TEELS_ERROR_INFO, TEELS_STAGES, isTeelsStage, readTeelsErrorDetail, safeTeelsSessionId, } from '../../../teelsTelemetry';
 import { SatyaErrorCode } from '../../../types/error.types';
 export const TEELS_BRIDGE_PROTOCOL_VERSION = 1;
 export const TEELS_BRIDGE_MAX_MESSAGE_BYTES = 256 * 1024;
@@ -7,6 +8,7 @@ export const TEELS_BRIDGE_MAX_NODES = 10_000;
 export const TEELS_FLOW_TIMEOUT_MS = 5 * 60_000;
 const TEELS_COMPLETE_MESSAGE = '__satyaTeelsComplete';
 const TEELS_ERROR_MESSAGE = '__satyaTeelsError';
+const TEELS_PROGRESS_MESSAGE = '__satyaTeelsProgress';
 let teelsAttemptSequence = 0;
 export function createTeelsAttemptId(cryptoSource = globalThis.crypto) {
     if (typeof cryptoSource?.randomUUID === 'function')
@@ -50,12 +52,12 @@ export function buildTeelsBridgeScript(options) {
     }
     return bytes;
   };
-  const post = (message) => {
+  const post = (message, isTerminal = true) => {
     if (terminal || !window.ReactNativeWebView || typeof window.ReactNativeWebView.postMessage !== 'function') return false;
     let serialized;
     try { serialized = JSON.stringify(message); } catch (_) { return false; }
     if (byteLength(serialized) > maxMessageBytes) return false;
-    terminal = true;
+    terminal = isTerminal;
     window.ReactNativeWebView.postMessage(serialized);
     return true;
   };
@@ -87,10 +89,17 @@ export function buildTeelsBridgeScript(options) {
     }
     return bounded ? bounded + ellipsis : undefined;
   };
-  const postError = (code, errorMessage) => {
+  const projectDetail = (value) => {
+    if (!value || typeof value !== 'object' || !${JSON.stringify(Object.keys(TEELS_ERROR_INFO))}.includes(value.code)) return undefined;
+    return { code: value.code,
+      ...(${JSON.stringify(TEELS_STAGES)}.includes(value.stage) ? { stage: value.stage } : {}),
+      ...(Number.isInteger(value.httpStatus) && value.httpStatus >= 100 && value.httpStatus <= 599 ? { httpStatus: value.httpStatus } : {}),
+      ...(typeof value.sessionId === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value.sessionId) ? { sessionId: value.sessionId } : {}) };
+  };
+  const postError = (code, errorMessage, errorDetail) => {
     const normalizedCode = code === 'attestation_missing' ? 'attestation_missing' : code === 'bridge_invalid' ? 'bridge_invalid' : 'teels_flow_failed';
     const detail = normalizedCode === 'teels_flow_failed' ? normalizeErrorMessage(errorMessage) : undefined;
-    return post({ type: ${JSON.stringify(TEELS_ERROR_MESSAGE)}, version: protocolVersion, providerId, attemptId, code: normalizedCode, ...(detail ? { errorMessage: detail } : {}) });
+    return post({ type: ${JSON.stringify(TEELS_ERROR_MESSAGE)}, version: protocolVersion, providerId, attemptId, code: normalizedCode, errorDetail: projectDetail(errorDetail), ...(detail ? { errorMessage: detail } : {}) });
   };
   const validate = (root) => {
     if (!root || typeof root !== 'object' || Array.isArray(root)) return false;
@@ -136,8 +145,13 @@ export function buildTeelsBridgeScript(options) {
       if (byteLength(serialized) > maxMessageBytes) { postError('bridge_invalid'); return; }
       post(message);
     },
-    fail(code, errorMessage) {
-      postError(code === 'attestation_missing' ? 'attestation_missing' : 'teels_flow_failed', errorMessage);
+    fail(code, errorMessage, errorDetail) {
+      postError(code === 'attestation_missing' ? 'attestation_missing' : 'teels_flow_failed', errorMessage, errorDetail);
+    },
+    progress(value) {
+      if (!value || !${JSON.stringify(TEELS_STAGES)}.includes(value.stage)) return;
+      const safe = projectDetail({ ...value, code: 'TEELS_UNKNOWN_ERROR' });
+      post({ type: ${JSON.stringify(TEELS_PROGRESS_MESSAGE)}, version: protocolVersion, providerId, attemptId, stage: safe.stage, sessionId: safe.sessionId }, false);
     }
   };
   Object.defineProperties(bridge, {
@@ -156,12 +170,14 @@ export function buildTeelsBridgeScript(options) {
 })();`;
 }
 export function parseTeelsBridgeMessage(raw, context) {
-    const oversized = utf8ByteLength(raw) > TEELS_BRIDGE_MAX_MESSAGE_BYTES;
-    if (oversized) {
-        return raw.includes('__satyaTeels')
-            ? { kind: 'error', code: SatyaErrorCode.TEELS_BRIDGE_INVALID }
-            : { kind: 'ignore' };
-    }
+    // Untrusted frames/old pages cannot settle an attempt, including oversized input.
+    if (!isExactOrigin(context.nativeEventUrl, context.expectedOrigin) ||
+        !isExactOrigin(context.committedUrl, context.expectedOrigin))
+        return { kind: 'ignore' };
+    // Our bridge turns oversize terminal payloads into a small correlated error.
+    // Do not parse oversized direct posts or guess their provider/attempt from text.
+    if (utf8ByteLength(raw) > TEELS_BRIDGE_MAX_MESSAGE_BYTES)
+        return { kind: 'ignore' };
     let decoded;
     try {
         decoded = JSON.parse(raw);
@@ -172,7 +188,9 @@ export function parseTeelsBridgeMessage(raw, context) {
     if (!isRecord(decoded))
         return { kind: 'ignore' };
     const type = decoded.type;
-    if (type !== TEELS_COMPLETE_MESSAGE && type !== TEELS_ERROR_MESSAGE) {
+    if (type !== TEELS_COMPLETE_MESSAGE &&
+        type !== TEELS_ERROR_MESSAGE &&
+        type !== TEELS_PROGRESS_MESSAGE) {
         return { kind: 'ignore' };
     }
     // Origin before correlation and version: only messages from the exact
@@ -187,6 +205,14 @@ export function parseTeelsBridgeMessage(raw, context) {
     if (decoded.version !== TEELS_BRIDGE_PROTOCOL_VERSION) {
         return { kind: 'error', code: SatyaErrorCode.TEELS_BRIDGE_INVALID };
     }
+    if (type === TEELS_PROGRESS_MESSAGE) {
+        return isTeelsStage(decoded.stage)
+            ? {
+                kind: 'progress',
+                progress: { stage: decoded.stage, sessionId: safeTeelsSessionId(decoded.sessionId) },
+            }
+            : { kind: 'ignore' };
+    }
     if (type === TEELS_ERROR_MESSAGE) {
         if (decoded.code === 'attestation_missing') {
             return { kind: 'error', code: SatyaErrorCode.TEELS_ATTESTATION_MISSING };
@@ -194,11 +220,13 @@ export function parseTeelsBridgeMessage(raw, context) {
         if (decoded.code === 'teels_flow_failed') {
             const detail = normalizeTeelsErrorMessage(decoded.errorMessage);
             const telemetry = projectTeelsErrorForTelemetry(detail);
+            const errorDetail = readTeelsErrorDetail(decoded.errorDetail);
             return {
                 kind: 'error',
                 code: SatyaErrorCode.TEELS_FLOW_FAILED,
                 ...(detail ? { detail } : {}),
                 ...telemetry,
+                ...(errorDetail ? { errorDetail } : {}),
             };
         }
         if (decoded.code === 'bridge_invalid') {
@@ -241,7 +269,7 @@ function projectTeelsErrorForTelemetry(detail) {
     // Closed, PII-free grammar for the currently deployed hosted provider. Keep
     // arbitrary TeeLS text local in SatyaError; the public ingest gets only this
     // known stage plus an integer status.
-    const match = /^login\.auth failed: HTTP ([1-5]\d{2})$/i.exec(detail);
+    const match = /^login\.auth failed: HTTP ([1-5]\d{2})(?: \(fields flagged: [^\r\n()]{1,256}\))?$/i.exec(detail);
     if (!match)
         return {};
     const httpStatus = Number(match[1]);