@burnt-labs/expo-satya-attest 3.7.1 → 3.8.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 3.8.0 - 2026-09-14
+
+### Fixed
+
+- Await WebKit cookies for iOS native replay, with a bounded timeout and correct
+  cookie scoping/expiry. Add iOS and Android cookie-read regression coverage.
+- Preserve verifier rejection details and relay failure causes; report TEE proof-generation health separately from verification.
+
+### Added
+
+- Add TEE stage logs, typed error reasons and correlated timing/error metadata to the existing SDK events.
+- Opt-in `attestationMode: 'tee-replay'` with the existing registry, WebView,
+  capture, proof-plan and partial-proof configuration. Default remains app attestation.
+- One quote authenticates the enclave keys and all replay targets; one signed
+  bundle carries full or partial results to `POST /v1/artifacts/verify` (schema 3.1.0).
+- Mode-aware `SatyaMobileClient.attestReplay` / `attestReplayBundle`, online TEE
+  verification, typed errors and optional `teeReplayServerUrl` / `teeTrustConfig` restrictions.
+- Device egress relay with provider certificate and hostname checks inside the TEE.
+  Provider SPKI pins remain specific to native replay. TEE makes no app/device identity
+  or residential-IP/location claim.
+- Credential-free quote preparation during eligible capture and ordered same-origin
+  TLS connection reuse within one bundle. Replay requests are never automatically retried.
+- `/tee` `getTeeClaims` returns endpoint-scoped claims with exact JSON text for
+  single, multiple and partial runs; requires the matching verifier's claim attribution.
+
+### Integration
+
+- For TEE, import from `@burnt-labs/expo-satya-attest/tee`, install the optional
+  `react-native-tcp-socket` peer and rebuild the native app. WebView cookies and
+  secure randomness use this SDK's native bridge; no cookie package, Gradle patch
+  or RNG polyfill is required. See [TEE setup](./TEE_REPLAY.md).
+- Existing app-attestation imports and callback types are unchanged and do not
+  require the TCP peer. Only `/tee` uses the native/TEE artifact union; see
+  [result types](./TEE_REPLAY.md#result-types).
+- This release prioritizes app attestation. TEE service readiness is deferred to
+  a follow-up patch release. Deploy and validate the matching verifier and
+  measured replay service before enabling TEE.
+  TEE verification is online and single-use; preserve opaque artifact bytes.
+- TEE respects explicit transport app IDs and the same provider policy hash rules
+  as native mode. Partial init calls preserve the selected mode; switch back explicitly
+  with `attestationMode: 'app-attestation'` before remounting the button.
+
 ## 3.7.1 - 2026-09-09
 
 ### Fixed

package/PROVIDER_CONFIG.md

@@ -1,5 +1,10 @@
 # Provider Config
 
+App-attestation and TEE replay use the same registry configuration. TEE ignores
+SPKI pins while retaining exact host authorization and enclave certificate/hostname
+checks; one quote-bound bundle covers full/partial proof plans. See
+[TEE compatibility and setup](./TEE_REPLAY.md#provider-features).
+
 A provider config is **trusted policy** for the native replay flow. One config decides:
 
 - which URL may be replayed (`endpoints[].url` + `tlsIdentityPolicy`),

package/PUBLISHING.md

@@ -10,6 +10,36 @@ very large native artifacts. The npm tarball still needs the native artifacts un
 package is redesigned to download or build them during install, which is not recommended
 for a plug-and-play Expo SDK.
 
+## 3.8.0 release preparation
+
+Version 3.8.0 prioritizes app attestation and can be published before TEE service
+readiness, which is deferred to a follow-up patch release. TEE remains opt-in;
+deploy and validate the matching verifier and measured service before enabling
+it for consumers.
+
+Cloudflare operators deploy the durable-state
+migration before the verifier; Phala images are built/pushed manually using
+`deploy/phala/publish.sh`, then pinned by digest. See [TEE setup](./TEE_REPLAY.md).
+
+Rebuild all native artifacts from the release commit. TEE consumers use the `/tee`
+entry point and need a native build for the cookie bridge and optional TCP peer;
+app-attestation imports and callback types stay unchanged. No example-only patches are
+required. Keep captured requests, cookies, local env files and test results out
+of both Git and the package. The example and internal tests are excluded by the
+package whitelist; `check:pack` validates the resulting file list.
+
+Preparing a tarball does not publish it:
+
+```bash
+npm run release:check
+npm run test:entrypoint-bundles
+npm pack --pack-destination /tmp
+```
+
+Retain the tarball checksum and source commit with release evidence. Run Android
+native unit tests from the example's generated `android/` project with
+`./gradlew :burnt-labs-expo-satya-attest:testDebugUnitTest` after building it.
+
 ## Package Name
 
 Use the scoped public package owned by the Burnt npm organization:

package/README.md

@@ -5,6 +5,30 @@ the Rust `satya-sdk` / `satya-ffi` pipeline for artifact construction and verifi
 policy, while Swift and Kotlin provide platform-specific WebView capture, native HTTPS
 replay, hardware-backed signing, and platform attestation evidence.
 
+## TEE replay
+
+Import from `@burnt-labs/expo-satya-attest/tee` and use
+`initSatyaAttest({ appId, attestationMode: 'tee-replay' })` with the normal
+provider WebView and capture flow. The configured verifier advertises the replay
+service; the SDK seals captured credentials only after quote preflight, relays
+TLS through the device and submits family 3 to the same verification endpoint.
+TEE ignores provider SPKI pins; certificate-chain and hostname verification
+remain mandatory inside the enclave. One initial quote and one signed bundle
+cover all selected endpoints and authenticated partial outcomes. `onComplete`
+returns the opaque schema 3.1 envelope and verified completion metadata.
+
+For captured-request integrations, `SatyaMobileClient.attestReplay` and
+`attestReplayBundle` honor the init mode. Explicit `attestNativeReplay*` methods
+remain native APIs. TEE results require online verification; `verify(raw,
+transportConfig)` submits a TEE envelope to the shared endpoint. Finalization is
+single-use, so submitting an already verified proof again is rejected.
+
+For TEE, install the optional TCP native peer and rebuild the app; cookie access and randomness use
+the SDK native bridge. See [TEE setup and provider compatibility](./TEE_REPLAY.md).
+
+App-attestation-only consumers keep the default import and existing callback
+types. They do not need the TCP package or TEE configuration.
+
 ## Prerequisite: register your app for an app id
 
 **SDK 3.x requires an `appId`.** Register your app at
@@ -17,16 +41,15 @@ your app its providers, configure the id in any one of:
 - `initSatyaAttest({ appId })` at startup, or
 - `EXPO_PUBLIC_SATYA_APP_ID` in the build environment.
 
-The app id is public by design — verification is gated by OS attestation
-matching your registered identities plus a per-app provider allowlist, so
-possession of the id alone grants nothing, and store binaries ship no verifier
-secret. Without a configured app id a verifier-backed flow fails before the
+The app ID is public. Native mode checks registered OS identities and provider
+grants. TEE mode checks the provider grant and enclave evidence without asserting
+app/device identity. Store binaries ship no verifier secret. Without a configured app id a verifier-backed flow fails before the
 provider WebView opens with `APP_ID_REQUIRED`; a malformed id fails validation
 with `CONFIG_INVALID`. An unregistered or unapproved id fails at the verifier
 with `APP_NOT_REGISTERED` / `APP_DISABLED`, and an ungranted provider fails with
 `PROVIDER_ACCESS_DENIED`. See
 [`docs/MULTI_TENANT_VERIFICATION.md`](../../docs/MULTI_TENANT_VERIFICATION.md).
-Flows also fail with `app_platform_not_configured` when the app has no
+Native flows also fail with `app_platform_not_configured` when the app has no
 registered identity for the current platform, so register every platform you
 develop and test on.
 
@@ -47,6 +70,10 @@ therefore bounded, and verified **at their edges** — the interior of each wind
 | `react-native` | `>=0.81.0 <0.86.0` | 0.81.5 | 0.85.x |
 | `react-native-safe-area-context` | `>=5.6.0 <6.0.0` | 5.6.x | 5.6.x |
 | `react-native-webview` | `>=13.15.0 <14.0.0` | 13.15.0 | 13.16.x |
+| `react-native-tcp-socket` | `>=6.4.2 <7.0.0` | 6.4.2 | 6.4.x |
+
+`react-native-tcp-socket` belongs only to the `/tee` entry point. The root package
+does not impose a TCP dependency or version constraint on app-only consumers.
 
 Policy:
 
@@ -65,9 +92,9 @@ Policy:
   or the example app) outside its declared range; and this table differing from
   `package.json`.
 
-## Current Flow
+## App-attestation flow (default)
 
-The supported Expo flow is **certificate-pinned native replay**. Third-party apps can
+App-attestation mode uses **certificate-pinned native replay**. Third-party apps can
 use the SDK-owned button component for the full managed flow:
 
 1. The app renders `SatyaProviderAttestButton` with a provider id and transport config.
@@ -999,14 +1026,14 @@ HTTPS tunnel or deployed HTTPS endpoint.
 
 ## Provider Health Monitoring
 
-Every native replay reports one anonymous health ping to the Burnt provider
+Every native or TEE replay reports one anonymous health ping to the Burnt provider
 monitor (`POST https://provider-monitor.burnt.com/ingest`) so per-provider
 success rates and proof-generation latency show up on the shared dashboard. This
 is on by default and needs no app configuration or token.
 
 - `outcome: "ok"` fires as soon as the attestation artifact is produced, with
   `latencyMs` measured from captured-request handoff to artifact creation.
-- `outcome: "failed"` fires when the native replay pipeline fails to produce an
+- `outcome: "failed"` fires when the replay pipeline fails to produce an
   artifact (no latency attached).
 - Artifact verification — the embedded check and the backend verifier — is
   outside the ping: its result depends on device trust (App Attest / Play
@@ -1021,6 +1048,9 @@ unknown provider ids are acknowledged but not recorded.
 
 ## Funnel Event Logging
 
+TEE uses the same events with `mode: "tee-replay"`, structured stage errors and
+per-stage timings. See [TEE logging and troubleshooting](./TEE_REPLAY.md#logging-and-troubleshooting).
+
 The SDK emits seven lifecycle events — `PROVIDER_INIT`, `LOGIN_COMPLETED`,
 `ENDPOINT_MATCHED`, `NATIVE_REPLAY_SUCCESS`, `ATTESTATION_GENERATED`,
 `ATTESTATION_VERIFIED`, and `FAILED` — to the SDK-logs ingest
@@ -1031,7 +1061,7 @@ provider-registry Monitoring dashboard. **On by default**; opt out with
 - **Correlation:** each user task mints one UUID `sessionId`, held constant
   across retries (each attempt is numbered with `attemptIndex`) and embedded in
   native artifacts as the unsigned `sdkSessionId` envelope field. From
-  `ATTESTATION_GENERATED` on, events also carry the `attestationId` join key
+  `ATTESTATION_GENERATED` on, native events also carry the `attestationId` join key
   (for TeeLS flows, the claim's attestation id). The failure screen shows the
   `sessionId` with a Copy control for support hand-off. **Deploy the
   `sdkSessionId`-aware verifier before rolling out 3.4.0 clients** — older

package/TEE_REPLAY.md

@@ -0,0 +1,231 @@
+# TEE replay
+
+TEE mode uses the same provider registry, login WebView, capture rules and proof
+plans as app attestation. The captured request is replayed inside the TEE through
+an opaque TLS relay on the user's device. A matching verifier and measured TEE
+service must be deployed once by the operator.
+
+## Install and enable
+
+```bash
+npx expo install @burnt-labs/expo-satya-attest react-native-webview react-native-tcp-socket@6.4.2
+```
+
+For TEE, install the optional TCP peer and rebuild the native app. The SDK supplies WebView cookie
+access and OS randomness; no cookie package, patch, RNG import or custom proxy is
+needed. Expo Go cannot load these native modules; use a development or release build.
+Keep the SDK config plugin from the normal installation.
+TCP versions `>=6.4.2 <7.0.0` are checked only when starting the TEE relay;
+app-only integrations may keep their own TCP dependency version.
+
+```tsx
+import { initSatyaAttest, SatyaProviderAttestButton } from '@burnt-labs/expo-satya-attest/tee';
+
+initSatyaAttest({
+  appId: 'app_your-registered-app-id',
+  attestationMode: 'tee-replay',
+});
+
+export function ProveProfile() {
+  return (
+    <SatyaProviderAttestButton
+      providerId="kaggle.current_user.v1"
+      transportConfig={{ verifierUrl: 'https://your-verifier.example' }}
+      onComplete={(result) => {
+        if (result.backendVerify?.ok) {
+          // Use the verified claims and completion metadata.
+        }
+      }}
+      onError={(error) => console.warn(error.code)}
+    />
+  );
+}
+```
+
+Use an active public app ID with the required provider grant. In TEE mode the app
+ID selects registry access; it does not prove the app binary or device identity.
+Play Integrity / App Attest setup is needed only when testing app-attestation mode.
+
+The verifier advertises the TEE service URL and checks its quote before the SDK
+releases credentials. `teeReplayServerUrl` optionally restricts that URL;
+`teeTrustConfig` optionally narrows accepted identities. Neither is required in
+the app. HTTPS is required for live verifier/service traffic. Configuration
+mismatches fail the run; TEE never silently falls back to app attestation.
+
+## Provider features
+
+| Feature | TEE behavior |
+| --- | --- |
+| Registry templates | Use the existing provider ID and configuration. Inline `providerTemplate` is unsupported. |
+| WebView / capture | Uses the existing login, OAuth popup, injection, request matching and guarded rewrite flow. |
+| Multiple endpoints | Pass the existing `proofPlanId`. One quote and one signed bundle cover the selected endpoints. |
+| Partial proofs | Opt in with `partialEndpointProviderIds: [providerId]`, as in native mode. Inspect `completionMode`, `endpointIds`, `omittedEndpointIds` and `planComplete` in the verified result. |
+| Dynamic pinned hosts | Registry host-group membership remains enforced. TEE ignores SPKI pins and verifies the certificate chain and hostname inside the enclave. Native replay still enforces pins. |
+| GET / POST and mutations | Existing methods and bodies are replayed. A mutation can execute during capture and again during replay; there are no automatic replay retries. |
+| Account binding | `claim-equality` proves the governed account claims agree. `shared-session` returns `shared-proof-run`, which proves run membership without asserting account equality. |
+| Verification | Online through `POST /v1/artifacts/verify`, which distinguishes native and TEE artifacts. Deferred verification is unsupported. |
+
+Partial mode still attempts the full plan. Authenticated unsuccessful responses
+may be recorded as omissions; TLS, policy, parser and transport failures abort the
+run. Required account-binding endpoints cannot be omitted.
+
+The relay normally uses the device's egress. The proof does not attest residential
+IP, location or app/device integrity. A compromised phone can interrupt traffic
+or choose credentials it possesses, but cannot forge the enclave's provider TLS
+response or final signature.
+
+## Switch modes
+
+The `/tee` entry point supports both modes with the same callbacks. Keep using
+the default package import for app-attestation-only integrations: its native
+result types are unchanged, and it does not load or require the TCP peer.
+
+Initialize before mounting the button. To change modes, finish or cancel the
+current flow, call `initSatyaAttest({ attestationMode: nextMode })`, then remount
+the button, for example with `key={nextMode}`. Values are `app-attestation` and
+`tee-replay`; omitting the mode preserves its current value on later init calls.
+The example app provides an **Attestation mode** selector and keeps the selected
+provider, proof plan and completion preference when switching.
+
+For captured-request integrations, use `SatyaMobileClient.attestReplay` or
+`attestReplayBundle`. Explicit `attestNativeReplay*` methods always remain native.
+TEE methods return an already verified result. Final verification consumes the
+challenge once; do not verify the same completed proof a second time.
+
+Preserve `artifactBytesB64` as opaque bytes. Parsing and reserializing the signed
+JSON may round large numbers and invalidate it. Use claim `valueBytesB64` when
+exact JSON numeric values matter.
+
+## Result types
+
+Existing imports from `@burnt-labs/expo-satya-attest` retain the 3.7.x
+`SatyaProviderAttestationResult` and `onComplete` types. No callback migration is
+needed for app attestation. Using the default button with TEE selected reports
+a configuration error before opening the flow.
+
+Only imports from `@burnt-labs/expo-satya-attest/tee` use a native/TEE result union.
+Narrow its artifact before reading fields specific to either mode:
+
+```ts
+function handleComplete(result: SatyaProviderAttestationResult) {
+  const artifact = result.artifact;
+  if ('artifactBytesB64' in artifact) {
+    // TEE envelope: retain artifact.artifactBytesB64 and the backend verdict.
+    return;
+  }
+  // Native artifact: existing artifact.statement handling belongs here.
+}
+```
+
+Import `SatyaProviderAttestationResult` from the `/tee` entry point for this handler. Shared result/verification
+fields remain available in either mode. TEE claim `value` is a JSON convenience
+representation and can round numbers (or be null outside its numeric range);
+`valueBytesB64` carries the authenticated exact JSON value.
+
+## Read claims
+
+The signed TEE object uses `body.exchanges[].disclosure[]` for every run: one
+exchange for a single endpoint, several for a proof plan. Each disclosure has
+`name`, `sourcePath` and `value`; the value can contain nested objects and arrays.
+Keep the signed bytes intact and read claims from the trusted verifier response:
+
+```ts
+import { getTeeClaims } from '@burnt-labs/expo-satya-attest/tee';
+
+const claims = getTeeClaims(result.backendVerify);
+// Every entry: { endpointId, name, sourcePath, valueJson }
+for (const claim of claims) {
+  renderClaim(claim.endpointId, claim.name, claim.valueJson);
+}
+```
+
+`getTeeClaims` requires the matching verifier release: each verified claim carries
+an explicit `endpointId`, original `claimName` and exact `valueBytesB64`. Existing
+`name` and `value` response fields remain available. The helper preserves aliases
+containing `/`, keeps repeated names in different endpoints separate, and rejects
+duplicate endpoint/name pairs or malformed encodings. Omitted endpoints supply no claims;
+use `omittedEndpointIds` and `planComplete` for coverage.
+
+`valueJson` is exact JSON text, preserving strings, booleans, nested data, large
+integers and precise decimals. Parse it with your application's JSON parser when
+needed; ordinary `JSON.parse` can round numbers. No lossy fallback is used.
+
+This helper extracts data; it does not authenticate a caller-supplied verdict.
+Your backend must authorize using its own successful verifier response, never
+an `ok` flag or claims sent back by an untrusted mobile client. Verification is
+single-use, so route that final verification to your trusted backend and retain
+its result rather than submitting the same proof again.
+
+## Logging and troubleshooting
+
+TEE uses the same event names and logging service as App Attest. No service
+update or extra logging setup is required. Enable internal SDK logs separately:
+
+```ts
+initSatyaAttest({
+  appId: 'YOUR_APP_ID',
+  attestationMode: 'tee-replay',
+  logLevel: 'info',        // Stage completions and errors; 'debug' also logs starts.
+  eventLogging: true,     // Default; sends lifecycle events to SDK Monitoring.
+});
+```
+
+Internal entries use the `tee` scope and the existing logger/sink. Each stage
+logs its outcome and duration; no packet-by-packet logs are emitted. Use
+`logLevel: 'silent'` to disable internal logging independently of event delivery.
+
+The WebView emits `PROVIDER_INIT`, `LOGIN_COMPLETED` and `ENDPOINT_MATCHED` as
+usual. Successful replay emits `NATIVE_REPLAY_SUCCESS` (the existing wire name)
+and `ATTESTATION_GENERATED`; online verification emits `ATTESTATION_VERIFIED`.
+Every TEE event has `logData.mode: "tee-replay"`. Failed attempts emit one
+`FAILED` event with these fields when available:
+
+| Field | Meaning |
+| --- | --- |
+| `teeStage` | `configuration`, `challenge`, `session`, `quoteBinding`, `quoteVerification`, `credentials`, `sealing`, `relay`, `replay`, or `verification`. |
+| `errorCode`, `errorReason`, `errorMessage` | SDK error code, a typed local reason, and a safe summary. |
+| `httpStatus`, `requestId` | Service status and server correlation ID, when returned. |
+| `verifierErrorCode`, `verifierErrorClass`, `verifierErrorStage`, `retryable` | Structured verifier or replay-service error metadata; unknown server codes remain readable. |
+| `endpointId`, `proofPlanId`, `exchangeIndex`, `exchangeCount` | Selected proof and endpoint context; relay faults identify the failing slot. |
+| `teeChallengeMs`, `teeSessionMs`, `teeQuoteBindingMs`, `teeQuoteVerificationMs`, `teeCaptureMs`, `teeSealingMs`, `teeRelayMs`, `teeReplayMs`, `teeVerificationMs` | Completed stage durations. `latencyMs` on failure measures the failed stage. |
+| `totalElapsedMs` | Attempt elapsed time, including login/capture for the WebView flow. |
+
+`sessionId` is the common event correlation key and travels to verification as
+`sdkSessionId`. The verified event also carries `attestationId`, `completionMode`
+and `planComplete`. Speculative preparation can overlap WebView capture, so stage
+durations should not be summed as wall-clock latency. Successful stages are
+summarized on subsequent lifecycle events rather than adding new event names.
+
+`SatyaTeeStage`, `SatyaTeeErrorReason`, `SatyaTeeErrorContext`, `TEE_STAGES` and
+`TEE_ERROR_REASONS` are exported from `/tee`; their definitions live in
+`src/tee/errors.ts`. Errors remain compatible with `SatyaError` and its
+`diagnostics`. `SatyaTeeClient.verify*` preserves its result-returning API and
+adds structured `errorDetail` on a service rejection or malformed verifier response.
+Network failures, timeouts and cancellation still throw.
+
+`SatyaMobileClient.attestReplay*` also emits post-capture TEE lifecycle events.
+Low-level `SatyaTeeClient` operations provide internal stage logs and structured
+errors; the caller owns the surrounding UI lifecycle.
+
+Events send `logData` as a JSON string, allowlisted and capped at 2 KB. The new TEE stage
+records exclude request headers/bodies, cookies, relay tokens, raw upstream error
+messages, quotes and proofs, even with verbose logging enabled. Shared WebView
+verbose logging remains intended only for local debugging.
+The optional `eventLogBridgeDebug` tail remains off by default. Delivery is
+best effort with the existing queue/backoff; logging failures never retry a
+provider replay or change proof verification.
+
+TEE also sends the existing anonymous provider-generation health ping. Producing
+an artifact reports success before final verification; a subsequent verifier
+rejection does not turn that generation into a failure. No additional verifier
+monitor event names are introduced.
+Client setup failures also report failed generation; user cancellation is excluded.
+
+## Operator setup
+
+See the repository's [TEE protocol and verifier configuration](https://github.com/burnt-labs/tls-app-attest/blob/main/docs/TEE_REPLAY_MODE.md)
+and [Phala deployment guide](https://github.com/burnt-labs/tls-app-attest/blob/main/deploy/phala/README.md).
+Deploy durable state (when using Cloudflare), then the matching verifier, measured
+replay image and SDK. Pin the image digest and accept only verified deployment
+identities. A local verifier can use the atomic file journal with production DCAP
+verification; it does not need a local TEE or Cloudflare deployment.

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.satyaattest'
-version = '3.7.1'
+version = '3.8.0'
 
 android {
   namespace "expo.modules.satyaattest"
   defaultConfig {
     versionCode 1
-    versionName "3.7.1"
+    versionName "3.8.0"
     // StrongBox key attestation needs API 28+; basic Keystore attestation API 24+.
     minSdkVersion 24
   }

package/android/src/main/java/expo/modules/satyaattest/SatyaAttestModule.kt

@@ -113,6 +113,22 @@ class SatyaAttestModule : Module() {
       Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING)
     }
 
+    // OS entropy, encoded as unpadded base64url.
+    Function("secureRandomBytes") { count: Int ->
+      require(count in 1..4096) { "secureRandomBytes count must be 1..4096" }
+      val bytes = ByteArray(count)
+      SecureRandom().nextBytes(bytes)
+      Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING)
+    }
+
+    AsyncFunction("readWebViewCookies") { url: String ->
+      val parsed = url.toHttpUrl()
+      require(parsed.isHttps && parsed.username.isEmpty() && parsed.password.isEmpty()) {
+        "Cookie URL must be HTTPS without credentials"
+      }
+      CookieManager.getInstance().getCookie(parsed.toString()) ?: ""
+    }.runOnQueue(Queues.MAIN)
+
     AsyncFunction("initialize") { configJson: String -> transportConfigJson = configJson }
 
     AsyncFunction("dispose") { transportConfigJson = "{}" }
@@ -495,6 +511,7 @@ class SatyaAttestModule : Module() {
   // Backs ProofCookieJar seeding by the real WebView cookie store. Reads only;
   // proof replay never calls setCookie.
   private class CookieManagerGlobalStore : GlobalCookieStore {
+    // getCookie reads synchronously; flush() only persists to disk.
     override fun cookieHeader(url: String): String? =
       CookieManager.getInstance().getCookie(url)?.takeIf { it.isNotBlank() }
 
@@ -624,7 +641,7 @@ class SatyaAttestModule : Module() {
       replayTargetsById[exchange.endpointId] = target
     }
 
-    // Seed the proof-local jar for every governed replay path.
+    // Finish all WebView cookie reads before replay starts.
     val cookieSeedUrls = effectiveEndpointIds.map { endpointId ->
       replayTargetsById[endpointId]?.url
         ?: error("HOST_GROUP_INVALID: no resolved replay target for $endpointId")
@@ -1211,7 +1228,7 @@ class SatyaAttestModule : Module() {
         requestBuilder.header(key, value)
       }
     }
-    CookieManager.getInstance().getCookie(replayUrl)?.takeIf { it.isNotBlank() }?.let {
+    CookieManagerGlobalStore().cookieHeader(replayUrl)?.let {
       requestBuilder.header("Cookie", it)
     }
 

package/build/SatyaAttestModule.d.ts

@@ -3,6 +3,13 @@ import { VerifyResult } from './types';
 declare class SatyaAttestModule extends NativeModule<Record<string, never>> {
     satyaCoreVersion(): string;
     createWebViewBridgeCapability(): string;
+    /**
+     * OS entropy as unpadded base64url. Optional so a JS bundle running against a
+     * native binary built before 3.8.0 still type-checks; `tee/secureRandom.ts`
+     * falls back to `createWebViewBridgeCapability` in that case.
+     */
+    secureRandomBytes?(count: number): string;
+    readWebViewCookies(url: string): Promise<string>;
     attestNativeReplay(providerTemplateJson: string, capturedRequestJson: string | null): Promise<string>;
     attestNativeReplayBundle(providerTemplateJson: string, capturedRequestsJson: string, partialEndpointSelectionJson: string | null): Promise<string>;
     verifyArtifact(artifactJson: string): Promise<boolean>;

package/build/SatyaAttestModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttestModule.d.ts","sourceRoot":"","sources":["../src/SatyaAttestModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,OAAO,iBAAkB,SAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,gBAAgB,IAAI,MAAM;IAC1B,6BAA6B,IAAI,MAAM;IASvC,kBAAkB,CAChB,oBAAoB,EAAE,MAAM,EAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,MAAM,CAAC;IAElB,wBAAwB,CACtB,oBAAoB,EAAE,MAAM,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,4BAA4B,EAAE,MAAM,GAAG,IAAI,GAC1C,OAAO,CAAC,MAAM,CAAC;IAElB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IACtD,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAEnE,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IACxB,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3F,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,OAAO,GAC1B,OAAO,CAAC,OAAO,CAAC;IACnB,qFAAqF;IACrF,wBAAwB,CAAC,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC/D,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;CACtC;;AAED,wBAAqE"}
+{"version":3,"file":"SatyaAttestModule.d.ts","sourceRoot":"","sources":["../src/SatyaAttestModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,OAAO,iBAAkB,SAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,gBAAgB,IAAI,MAAM;IAC1B,6BAA6B,IAAI,MAAM;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IACzC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAShD,kBAAkB,CAChB,oBAAoB,EAAE,MAAM,EAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,MAAM,CAAC;IAElB,wBAAwB,CACtB,oBAAoB,EAAE,MAAM,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,4BAA4B,EAAE,MAAM,GAAG,IAAI,GAC1C,OAAO,CAAC,MAAM,CAAC;IAElB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IACtD,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAEnE,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IACxB,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3F,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,OAAO,GAC1B,OAAO,CAAC,OAAO,CAAC;IACnB,qFAAqF;IACrF,wBAAwB,CAAC,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC/D,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;CACtC;;AAED,wBAAqE"}

package/build/SatyaAttestModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttestModule.js","sourceRoot":"","sources":["../src/SatyaAttestModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AA0CzD,eAAe,mBAAmB,CAAoB,aAAa,CAAC,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from 'expo';\n\nimport { VerifyResult } from './types';\n\ndeclare class SatyaAttestModule extends NativeModule<Record<string, never>> {\n  satyaCoreVersion(): string;\n  createWebViewBridgeCapability(): string;\n\n  // Every parameter below is required, including the nullable ones. Whether iOS\n  // tolerates an omitted trailing optional depends on the host app's\n  // expo-modules-core (older 3.0.x cores and the optimized JSI path require all\n  // of them; 56.x relaxes trailing optionals), and `peerDependencies.expo` is\n  // `*`, so this package must satisfy the strictest of them. Marking these `?`\n  // would let TypeScript accept a call that crashes on device. See\n  // `nativeReplayArgs.ts` for the full mechanism.\n  attestNativeReplay(\n    providerTemplateJson: string,\n    capturedRequestJson: string | null\n  ): Promise<string>;\n\n  attestNativeReplayBundle(\n    providerTemplateJson: string,\n    capturedRequestsJson: string,\n    partialEndpointSelectionJson: string | null\n  ): Promise<string>;\n\n  verifyArtifact(artifactJson: string): Promise<boolean>;\n  verifyArtifactDetailed(artifactJson: string): Promise<VerifyResult>;\n\n  initialize(configJson: string): Promise<void>;\n  dispose(): Promise<void>;\n  installWebViewDocumentStartScript(viewTag: number, script: string): Promise<boolean | null>;\n  setPopupWindowsEnabled(\n    viewTag: number,\n    enabled: boolean,\n    geolocationEnabled: boolean\n  ): Promise<boolean>;\n  /** Optional for compatibility with native binaries predating privacy concealment. */\n  setPopupWindowsConcealed?(concealed: boolean): Promise<boolean>;\n  closePopupWindows(): Promise<boolean>;\n}\n\nexport default requireNativeModule<SatyaAttestModule>('SatyaAttest');\n"]}
+{"version":3,"file":"SatyaAttestModule.js","sourceRoot":"","sources":["../src/SatyaAttestModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAiDzD,eAAe,mBAAmB,CAAoB,aAAa,CAAC,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from 'expo';\n\nimport { VerifyResult } from './types';\n\ndeclare class SatyaAttestModule extends NativeModule<Record<string, never>> {\n  satyaCoreVersion(): string;\n  createWebViewBridgeCapability(): string;\n  /**\n   * OS entropy as unpadded base64url. Optional so a JS bundle running against a\n   * native binary built before 3.8.0 still type-checks; `tee/secureRandom.ts`\n   * falls back to `createWebViewBridgeCapability` in that case.\n   */\n  secureRandomBytes?(count: number): string;\n  readWebViewCookies(url: string): Promise<string>;\n\n  // Every parameter below is required, including the nullable ones. Whether iOS\n  // tolerates an omitted trailing optional depends on the host app's\n  // expo-modules-core (older 3.0.x cores and the optimized JSI path require all\n  // of them; 56.x relaxes trailing optionals), and `peerDependencies.expo` is\n  // `*`, so this package must satisfy the strictest of them. Marking these `?`\n  // would let TypeScript accept a call that crashes on device. See\n  // `nativeReplayArgs.ts` for the full mechanism.\n  attestNativeReplay(\n    providerTemplateJson: string,\n    capturedRequestJson: string | null\n  ): Promise<string>;\n\n  attestNativeReplayBundle(\n    providerTemplateJson: string,\n    capturedRequestsJson: string,\n    partialEndpointSelectionJson: string | null\n  ): Promise<string>;\n\n  verifyArtifact(artifactJson: string): Promise<boolean>;\n  verifyArtifactDetailed(artifactJson: string): Promise<VerifyResult>;\n\n  initialize(configJson: string): Promise<void>;\n  dispose(): Promise<void>;\n  installWebViewDocumentStartScript(viewTag: number, script: string): Promise<boolean | null>;\n  setPopupWindowsEnabled(\n    viewTag: number,\n    enabled: boolean,\n    geolocationEnabled: boolean\n  ): Promise<boolean>;\n  /** Optional for compatibility with native binaries predating privacy concealment. */\n  setPopupWindowsConcealed?(concealed: boolean): Promise<boolean>;\n  closePopupWindows(): Promise<boolean>;\n}\n\nexport default requireNativeModule<SatyaAttestModule>('SatyaAttest');\n"]}

package/build/SatyaAttestModule.web.d.ts

@@ -3,6 +3,7 @@ import { VerifyResult } from './types';
 declare class SatyaAttestModule extends NativeModule<Record<string, never>> {
     satyaCoreVersion(): string;
     createWebViewBridgeCapability(): string;
+    readWebViewCookies(_url: string): Promise<string>;
     attestNativeReplay(_providerTemplateJson: string, _capturedRequestJson: string | null): Promise<string>;
     attestNativeReplayBundle(_providerTemplateJson: string, _capturedRequestsJson: string, _partialEndpointSelectionJson: string | null): Promise<string>;
     verifyArtifact(_artifactJson: string): Promise<boolean>;

package/build/SatyaAttestModule.web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttestModule.web.d.ts","sourceRoot":"","sources":["../src/SatyaAttestModule.web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAMvC,cAAM,iBAAkB,SAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,gBAAgB,IAAI,MAAM;IAG1B,6BAA6B,IAAI,MAAM;IAGjC,kBAAkB,CACtB,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;IAGZ,wBAAwB,CAC5B,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,EAC7B,6BAA6B,EAAE,MAAM,GAAG,IAAI,GAC3C,OAAO,CAAC,MAAM,CAAC;IAGZ,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGvD,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAGpE,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;;AAMD,wBAAyE"}
+{"version":3,"file":"SatyaAttestModule.web.d.ts","sourceRoot":"","sources":["../src/SatyaAttestModule.web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAMvC,cAAM,iBAAkB,SAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,gBAAgB,IAAI,MAAM;IAG1B,6BAA6B,IAAI,MAAM;IAGjC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAGjD,kBAAkB,CACtB,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;IAGZ,wBAAwB,CAC5B,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,EAC7B,6BAA6B,EAAE,MAAM,GAAG,IAAI,GAC3C,OAAO,CAAC,MAAM,CAAC;IAGZ,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGvD,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAGpE,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;;AAMD,wBAAyE"}

package/build/SatyaAttestModule.web.js

@@ -8,6 +8,9 @@ class SatyaAttestModule extends NativeModule {
     createWebViewBridgeCapability() {
         throw unsupportedPlatformError();
     }
+    async readWebViewCookies(_url) {
+        throw unsupportedPlatformError();
+    }
     async attestNativeReplay(_providerTemplateJson, _capturedRequestJson) {
         throw unsupportedPlatformError();
     }

package/build/SatyaAttestModule.web.js.map

@@ -1 +1 @@
-{"version":3,"file":"SatyaAttestModule.web.js","sourceRoot":"","sources":["../src/SatyaAttestModule.web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,WAAW,GACf,uFAAuF,CAAC;AAE1F,MAAM,iBAAkB,SAAQ,YAAmC;IACjE,gBAAgB;QACd,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,6BAA6B;QAC3B,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,kBAAkB,CACtB,qBAA6B,EAC7B,oBAAmC;QAEnC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,wBAAwB,CAC5B,qBAA6B,EAC7B,qBAA6B,EAC7B,6BAA4C;QAE5C,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,aAAqB;QAChD,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,OAAO;QACX,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;CACF;AAED,SAAS,wBAAwB;IAC/B,MAAM,UAAU,CAAC,cAAc,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AACrE,CAAC;AAED,eAAe,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC","sourcesContent":["import { registerWebModule, NativeModule } from 'expo';\n\nimport { VerifyResult } from './types';\nimport { SatyaErrorCode, satyaError } from './types/error.types';\n\nconst UNSUPPORTED =\n  'expo-satya-attest is not available on web (it requires native App Attest / Keystore).';\n\nclass SatyaAttestModule extends NativeModule<Record<string, never>> {\n  satyaCoreVersion(): string {\n    throw unsupportedPlatformError();\n  }\n  createWebViewBridgeCapability(): string {\n    throw unsupportedPlatformError();\n  }\n  async attestNativeReplay(\n    _providerTemplateJson: string,\n    _capturedRequestJson: string | null\n  ): Promise<string> {\n    throw unsupportedPlatformError();\n  }\n  async attestNativeReplayBundle(\n    _providerTemplateJson: string,\n    _capturedRequestsJson: string,\n    _partialEndpointSelectionJson: string | null\n  ): Promise<string> {\n    throw unsupportedPlatformError();\n  }\n  async verifyArtifact(_artifactJson: string): Promise<boolean> {\n    throw unsupportedPlatformError();\n  }\n  async verifyArtifactDetailed(_artifactJson: string): Promise<VerifyResult> {\n    throw unsupportedPlatformError();\n  }\n  async initialize(_configJson: string): Promise<void> {\n    throw unsupportedPlatformError();\n  }\n  async dispose(): Promise<void> {\n    throw unsupportedPlatformError();\n  }\n}\n\nfunction unsupportedPlatformError(): never {\n  throw satyaError(SatyaErrorCode.UNSUPPORTED_PLATFORM, UNSUPPORTED);\n}\n\nexport default registerWebModule(SatyaAttestModule, 'SatyaAttestModule');\n"]}
+{"version":3,"file":"SatyaAttestModule.web.js","sourceRoot":"","sources":["../src/SatyaAttestModule.web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,WAAW,GACf,uFAAuF,CAAC;AAE1F,MAAM,iBAAkB,SAAQ,YAAmC;IACjE,gBAAgB;QACd,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,6BAA6B;QAC3B,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACnC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,kBAAkB,CACtB,qBAA6B,EAC7B,oBAAmC;QAEnC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,wBAAwB,CAC5B,qBAA6B,EAC7B,qBAA6B,EAC7B,6BAA4C;QAE5C,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,aAAqB;QAChD,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,OAAO;QACX,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;CACF;AAED,SAAS,wBAAwB;IAC/B,MAAM,UAAU,CAAC,cAAc,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AACrE,CAAC;AAED,eAAe,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC","sourcesContent":["import { registerWebModule, NativeModule } from 'expo';\n\nimport { VerifyResult } from './types';\nimport { SatyaErrorCode, satyaError } from './types/error.types';\n\nconst UNSUPPORTED =\n  'expo-satya-attest is not available on web (it requires native App Attest / Keystore).';\n\nclass SatyaAttestModule extends NativeModule<Record<string, never>> {\n  satyaCoreVersion(): string {\n    throw unsupportedPlatformError();\n  }\n  createWebViewBridgeCapability(): string {\n    throw unsupportedPlatformError();\n  }\n  async readWebViewCookies(_url: string): Promise<string> {\n    throw unsupportedPlatformError();\n  }\n  async attestNativeReplay(\n    _providerTemplateJson: string,\n    _capturedRequestJson: string | null\n  ): Promise<string> {\n    throw unsupportedPlatformError();\n  }\n  async attestNativeReplayBundle(\n    _providerTemplateJson: string,\n    _capturedRequestsJson: string,\n    _partialEndpointSelectionJson: string | null\n  ): Promise<string> {\n    throw unsupportedPlatformError();\n  }\n  async verifyArtifact(_artifactJson: string): Promise<boolean> {\n    throw unsupportedPlatformError();\n  }\n  async verifyArtifactDetailed(_artifactJson: string): Promise<VerifyResult> {\n    throw unsupportedPlatformError();\n  }\n  async initialize(_configJson: string): Promise<void> {\n    throw unsupportedPlatformError();\n  }\n  async dispose(): Promise<void> {\n    throw unsupportedPlatformError();\n  }\n}\n\nfunction unsupportedPlatformError(): never {\n  throw satyaError(SatyaErrorCode.UNSUPPORTED_PLATFORM, UNSUPPORTED);\n}\n\nexport default registerWebModule(SatyaAttestModule, 'SatyaAttestModule');\n"]}

package/build/SatyaMobileClient.d.ts

@@ -1,10 +1,11 @@
-import type { SatyaBackendVerifyResult } from './components/providerAttest/types';
+import type { SatyaBackendVerifyResult, SatyaTeeProviderAttestationResult } from './components/providerAttest/types';
 import { SatyaArtifact, CapturedProviderRequest, SatyaProviderTemplate, SatyaProgress, SatyaTransportConfig, VerifyResult } from './types';
 type ProgressListener = (progress: SatyaProgress) => void;
 export interface NativeReplayAttestArgs {
     providerTemplate: SatyaProviderTemplate;
     transportConfig: SatyaTransportConfig;
     capturedRequest?: CapturedProviderRequest | null;
+    signal?: AbortSignal;
 }
 export interface NativeReplayBundleAttestArgs {
     providerTemplate: SatyaProviderTemplate;
@@ -15,6 +16,8 @@ export interface NativeReplayBundleAttestArgs {
     partialEndpointsAllowed?: boolean;
     signal?: AbortSignal;
 }
+/** Evidence stays discriminated: native signed statement or opaque TEE envelope. */
+export type ModeAwareAttestOutcome = AttestOutcome | SatyaTeeProviderAttestationResult;
 export interface AttestOutcome {
     artifact: SatyaArtifact;
     raw: string;
@@ -26,6 +29,11 @@ export declare class SatyaMobileClient {
     private readonly listeners;
     subscribeProgress(listener: ProgressListener): () => void;
     private emit;
+    /** Uses the init mode with the same captured request and registry provider. */
+    attestReplay(args: NativeReplayAttestArgs): Promise<ModeAwareAttestOutcome>;
+    /** Runs one proof plan using the init mode; TEE success is verified online. */
+    attestReplayBundle(args: NativeReplayBundleAttestArgs): Promise<ModeAwareAttestOutcome>;
+    private attestTeeRun;
     attestNativeReplay(args: NativeReplayAttestArgs): Promise<AttestOutcome>;
     /**
      * Composite proof-plan replay: one native call replays every plan endpoint
@@ -34,7 +42,7 @@ export declare class SatyaMobileClient {
      * matching — the TypeScript-side record is convenience, not authority.
      */
     attestNativeReplayBundle(args: NativeReplayBundleAttestArgs): Promise<AttestOutcome>;
-    verify(artifactJson: string): Promise<VerifyResult>;
+    verify(artifactJson: string, transportConfig?: SatyaTransportConfig): Promise<VerifyResult>;
     coreVersion(): string;
     dispose(): Promise<void>;
 }