@symbiote-native/app-integrity 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 A. Prokopenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,149 @@
+# @symbiote-native/app-integrity
+
+Let your backend tell your real app on a real device apart from a modified app, a script or an
+emulator. One API for every [SymbioteNative](../../README.md) adapter (React, Vue, Svelte, Solid
+and Angular).
+
+It wraps [`@expo/app-integrity`](https://github.com/expo/expo/tree/main/packages/expo-app-integrity)
+(Apple's App Attest, Google Play Integrity, and Android hardware-attested key generation). Like
+[`@symbiote-native/application`](../application), everything here is a one-shot async call (or a
+plain sync constant) with no per-instance state, so there is no hook, composable or service to
+wrap: every adapter entry point is a plain re-export of the same `core`.
+
+## Install
+
+**New app:**
+
+```bash
+npx @symbiote-native/cli new my-app --app-integrity
+```
+
+**Existing SymbioteNative app:**
+
+```bash
+npx @symbiote-native/cli add --app-integrity
+```
+
+Either way: installs `@symbiote-native/app-integrity` and wires the native autolinking
+automatically, see [`@symbiote-native/cli`](../cli).
+
+<details>
+<summary>Manual install (no CLI, wiring native autolinking by hand)</summary>
+
+```bash
+npm install @symbiote-native/app-integrity
+```
+
+`@expo/app-integrity` and `expo-modules-core` come along as regular dependencies, pinned to exact
+versions. Never install either yourself, and never add the `expo` meta-package to your project
+(it bundles its own Metro/Babel pipeline, which conflicts with this project's own).
+
+## Required one-time step: native autolinking wiring
+
+Unlike a plain RN native module, `@expo/app-integrity`'s native code is discovered by
+`expo-modules-autolinking`, not RN's own `react-native.config.cjs` mechanism. This needs wiring
+into the native host app **once**, covering this package and every other `expo-modules-core`
+package with zero further changes:
+
+| Platform | Touches                                                                                                                                        |
+| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| iOS      | `ios/Podfile`, add `use_expo_modules!`                                                                                                           |
+| iOS      | `AppDelegate.swift`, Expo's runtime-bootstrap hook                                                                                                |
+| Android  | `settings.gradle` / `app/build.gradle`, resolve and include the Expo Gradle projects                                                              |
+| Android  | `MainApplication.kt`, Expo's bootstrap hook, plus a hand-written native-module name map (there's no `expo` meta-package here to auto-generate one) |
+
+Full mechanics live in the `symbiote-expo-native-module` project skill. Reference
+implementation: `examples/expo-react/ios/Podfile` and
+`examples/expo-react/android/app/src/main/java/com/canaryexpo/MainApplication.kt`.
+
+No app-level permission strings are needed. App Attest, Play Integrity, and hardware attestation
+are all system services with no user-facing permission prompt.
+
+Each platform needs one setup step of its own: on iOS, add the **App Attest** capability in Xcode
+(Signing & Capabilities; the app needs a registered App ID); on Android, enable the Play Integrity
+API for your app and note your Google Cloud project number.
+
+</details>
+
+## Shape
+
+```
+src/core/     isSupported constant, generateKeyAsync / attestKeyAsync / generateAssertionAsync
+              (App Attest, ios), prepareIntegrityTokenProviderAsync / requestIntegrityCheckAsync
+              (Play Integrity, android), isHardwareAttestationSupportedAsync /
+              generateHardwareAttestedKeyAsync / getAttestationCertificateChainAsync (hardware
+              attestation, android). native-module.ts resolves the native module via
+              expo-modules-core's requireNativeModule.
+src/angular/  @symbiote-native/app-integrity/angular, export * from '../core'
+```
+
+`./react`, `./vue`, `./svelte`, and `./solid` are `exports`-map aliases straight onto `src/core/`,
+no physical per-framework file, since there's nothing to subscribe to or clean up. `./angular`
+stays a physical file/subpath since Angular ships through a separate `ngc`/AOT build (`build-ngc/`).
+
+## API
+
+```ts
+isSupported: boolean // ios: real App Attest support; off ios: always true
+
+generateKeyAsync(): Promise<string> // ios only
+attestKeyAsync(keyId: string, challenge: string): Promise<string> // ios only
+generateAssertionAsync(keyId: string, challenge: string): Promise<string> // ios only
+
+prepareIntegrityTokenProviderAsync(cloudProjectNumber: string): Promise<void> // android only
+requestIntegrityCheckAsync(requestHash: string): Promise<string> // android only
+
+isHardwareAttestationSupportedAsync(): Promise<boolean> // android only, false elsewhere
+generateHardwareAttestedKeyAsync(keyAlias: string, challenge: string): Promise<void> // android only
+getAttestationCertificateChainAsync(keyAlias: string): Promise<string[]> // android only
+```
+
+```ts
+import {
+  generateKeyAsync,
+  isSupported,
+} from '@symbiote-native/app-integrity';
+// or the framework-scoped entry points, identical surface, re-exported verbatim:
+import { generateKeyAsync } from '@symbiote-native/app-integrity/react';
+import { generateKeyAsync } from '@symbiote-native/app-integrity/vue';
+import { generateKeyAsync } from '@symbiote-native/app-integrity/angular';
+```
+
+## Notes
+
+- **Every function throws `UnavailabilityError` when called on the wrong platform** (an
+  iOS-only App Attest function on Android, or an Android-only function on iOS), except
+  `isHardwareAttestationSupportedAsync`, which resolves `false` instead, matching upstream.
+- `isSupported` is a plain constant read once at import time from the native `Constant`, `true`
+  on any non-iOS platform since App Attest has no Android/web equivalent to report on.
+- The App Attest trio (`generateKeyAsync`/`attestKeyAsync`/`generateAssertionAsync`) is a
+  three-step flow: generate a key, have Apple attest it once, then generate per-request
+  assertions against the attested key. Send the attestation and each assertion to your own
+  server for verification, this package only produces the client-side artifacts.
+- `generateHardwareAttestedKeyAsync`/`getAttestationCertificateChainAsync` target the Android
+  Keystore directly (works on GrapheneOS and other secure Android distributions), independent of
+  Play Integrity's `prepareIntegrityTokenProviderAsync`/`requestIntegrityCheckAsync` pair.
+- If the Android token provider is reused for too long, the next token request fails with
+  `ERR_APP_INTEGRITY_PROVIDER_INVALID`. Call `prepareIntegrityTokenProviderAsync` again and retry.
+- Verify on your server, never on the device: a check that runs only in the app can be bypassed by
+  the clients you are guarding against. The canary `AppIntegrityScreen` in the `examples/expo-*`
+  apps exercises every call.
+
+## Common questions
+
+- **`ERR_APP_INTEGRITY_PROVIDER_INVALID`.** The token provider expired; call
+  `prepareIntegrityTokenProviderAsync` again.
+- **Per-platform flow?** Android: Play Integrity Standard request (prepare once, token per action).
+  iOS: App Attest key per user per device, attested once.
+- **Enough alone?** No, verify the token on your server.
+
+Sources: [Expo docs: AppIntegrity](https://docs.expo.dev/versions/latest/sdk/app-integrity/),
+[Expo blog: Introducing Expo App Integrity](https://expo.dev/blog/expo-app-integrity).
+
+## Test it
+
+No Fabric/Descriptor angle at all, every export here is a one-shot async function or a plain
+constant, never a view or per-instance state. Tests inject a fake native-module object in place
+of the real `requireNativeModule` resolution (`src/core/app-integrity.test.ts`, `vitest`), no
+`installFabric()`, no ViewConfig. Native behavior itself is verified on-device (see the parent
+[README](../../README.md) for the project's testing model).

package/build/angular/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build/angular/index.js

@@ -0,0 +1,2 @@
+// No per-instance state or event stream to wrap in an injectable service, plain re-export
+export * from '../core/index.js';

package/build/core/app-integrity.d.ts

@@ -0,0 +1,18 @@
+/** @platform ios, true off ios since App Attest support has no Android/web equivalent */
+export declare const isSupported: boolean;
+/** Creates a new App Attest key, stored in the Secure Enclave. @platform ios */
+export declare function generateKeyAsync(): Promise<string>;
+/** Asks Apple to attest to the validity of a key generated by `generateKeyAsync`. @platform ios */
+export declare function attestKeyAsync(keyId: string, challenge: string): Promise<string>;
+/** @platform ios */
+export declare function generateAssertionAsync(keyId: string, challenge: string): Promise<string>;
+/** @platform android */
+export declare function prepareIntegrityTokenProviderAsync(cloudProjectNumber: string): Promise<void>;
+/** @platform android */
+export declare function requestIntegrityCheckAsync(requestHash: string): Promise<string>;
+/** @platform android, `false` off android rather than throwing */
+export declare function isHardwareAttestationSupportedAsync(): Promise<boolean>;
+/** Usable on GrapheneOS and other secure Android distributions. @platform android */
+export declare function generateHardwareAttestedKeyAsync(keyAlias: string, challenge: string): Promise<void>;
+/** Base64-encoded X.509 certificates, verify server-side. @platform android */
+export declare function getAttestationCertificateChainAsync(keyAlias: string): Promise<string[]>;

package/build/core/app-integrity.js

@@ -0,0 +1,66 @@
+import { Platform, UnavailabilityError } from 'expo-modules-core';
+import { expoAppIntegrity } from './native-module.js';
+const NATIVE_MODULE_NAME = 'expo-app-integrity';
+/** @platform ios, true off ios since App Attest support has no Android/web equivalent */
+export const isSupported = Platform.OS === 'ios' ? (expoAppIntegrity.isSupported ?? false) : true;
+/** Creates a new App Attest key, stored in the Secure Enclave. @platform ios */
+export async function generateKeyAsync() {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.generateKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateKeyAsync');
+    }
+    return expoAppIntegrity.generateKeyAsync();
+}
+/** Asks Apple to attest to the validity of a key generated by `generateKeyAsync`. @platform ios */
+export async function attestKeyAsync(keyId, challenge) {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.attestKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'attestKeyAsync');
+    }
+    return expoAppIntegrity.attestKeyAsync(keyId, challenge);
+}
+/** @platform ios */
+export async function generateAssertionAsync(keyId, challenge) {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.generateAssertionAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateAssertionAsync');
+    }
+    return expoAppIntegrity.generateAssertionAsync(keyId, challenge);
+}
+/** @platform android */
+export async function prepareIntegrityTokenProviderAsync(cloudProjectNumber) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.prepareIntegrityTokenProviderAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'prepareIntegrityTokenProviderAsync');
+    }
+    return expoAppIntegrity.prepareIntegrityTokenProviderAsync(cloudProjectNumber);
+}
+/** @platform android */
+export async function requestIntegrityCheckAsync(requestHash) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.requestIntegrityCheckAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'requestIntegrityCheckAsync');
+    }
+    return expoAppIntegrity.requestIntegrityCheckAsync(requestHash);
+}
+/** @platform android, `false` off android rather than throwing */
+export async function isHardwareAttestationSupportedAsync() {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.isHardwareAttestationSupportedAsync) {
+        return false;
+    }
+    return expoAppIntegrity.isHardwareAttestationSupportedAsync();
+}
+/** Usable on GrapheneOS and other secure Android distributions. @platform android */
+export async function generateHardwareAttestedKeyAsync(keyAlias, challenge) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.generateHardwareAttestedKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateHardwareAttestedKeyAsync');
+    }
+    return expoAppIntegrity.generateHardwareAttestedKeyAsync(keyAlias, challenge);
+}
+/** Base64-encoded X.509 certificates, verify server-side. @platform android */
+export async function getAttestationCertificateChainAsync(keyAlias) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.getAttestationCertificateChainAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'getAttestationCertificateChainAsync');
+    }
+    return expoAppIntegrity.getAttestationCertificateChainAsync(keyAlias);
+}

package/build/core/index.d.ts

@@ -0,0 +1 @@
+export { attestKeyAsync, generateAssertionAsync, generateHardwareAttestedKeyAsync, generateKeyAsync, getAttestationCertificateChainAsync, isHardwareAttestationSupportedAsync, isSupported, prepareIntegrityTokenProviderAsync, requestIntegrityCheckAsync, } from './app-integrity';

package/build/core/index.js

@@ -0,0 +1 @@
+export { attestKeyAsync, generateAssertionAsync, generateHardwareAttestedKeyAsync, generateKeyAsync, getAttestationCertificateChainAsync, isHardwareAttestationSupportedAsync, isSupported, prepareIntegrityTokenProviderAsync, requestIntegrityCheckAsync, } from './app-integrity.js';

package/build/core/native-module.d.ts

@@ -0,0 +1,12 @@
+export type INativeAppIntegrityModule = {
+    isSupported?: boolean;
+    generateKeyAsync?(): Promise<string>;
+    attestKeyAsync?(keyId: string, challenge: string): Promise<string>;
+    generateAssertionAsync?(keyId: string, challenge: string): Promise<string>;
+    prepareIntegrityTokenProviderAsync?(cloudProjectNumber: string): Promise<void>;
+    requestIntegrityCheckAsync?(requestHash: string): Promise<string>;
+    isHardwareAttestationSupportedAsync?(): Promise<boolean>;
+    generateHardwareAttestedKeyAsync?(keyAlias: string, challenge: string): Promise<void>;
+    getAttestationCertificateChainAsync?(keyAlias: string): Promise<string[]>;
+};
+export declare const expoAppIntegrity: INativeAppIntegrityModule;

package/build/core/native-module.js

@@ -0,0 +1,3 @@
+import { requireNativeModule } from 'expo-modules-core';
+const EXPO_APP_INTEGRITY_MODULE_NAME = 'ExpoAppIntegrity';
+export const expoAppIntegrity = requireNativeModule(EXPO_APP_INTEGRITY_MODULE_NAME);

package/build-ngc/angular/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build-ngc/angular/index.js

@@ -0,0 +1,3 @@
+// No per-instance state or event stream to wrap in an injectable service, plain re-export
+export * from '../core';
+//# sourceMappingURL=index.js.map

package/build-ngc/angular/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/angular/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,cAAc,SAAS,CAAC"}

package/build-ngc/core/app-integrity.d.ts

@@ -0,0 +1,18 @@
+/** @platform ios, true off ios since App Attest support has no Android/web equivalent */
+export declare const isSupported: boolean;
+/** Creates a new App Attest key, stored in the Secure Enclave. @platform ios */
+export declare function generateKeyAsync(): Promise<string>;
+/** Asks Apple to attest to the validity of a key generated by `generateKeyAsync`. @platform ios */
+export declare function attestKeyAsync(keyId: string, challenge: string): Promise<string>;
+/** @platform ios */
+export declare function generateAssertionAsync(keyId: string, challenge: string): Promise<string>;
+/** @platform android */
+export declare function prepareIntegrityTokenProviderAsync(cloudProjectNumber: string): Promise<void>;
+/** @platform android */
+export declare function requestIntegrityCheckAsync(requestHash: string): Promise<string>;
+/** @platform android, `false` off android rather than throwing */
+export declare function isHardwareAttestationSupportedAsync(): Promise<boolean>;
+/** Usable on GrapheneOS and other secure Android distributions. @platform android */
+export declare function generateHardwareAttestedKeyAsync(keyAlias: string, challenge: string): Promise<void>;
+/** Base64-encoded X.509 certificates, verify server-side. @platform android */
+export declare function getAttestationCertificateChainAsync(keyAlias: string): Promise<string[]>;

package/build-ngc/core/app-integrity.js

@@ -0,0 +1,67 @@
+import { Platform, UnavailabilityError } from 'expo-modules-core';
+import { expoAppIntegrity } from './native-module';
+const NATIVE_MODULE_NAME = 'expo-app-integrity';
+/** @platform ios, true off ios since App Attest support has no Android/web equivalent */
+export const isSupported = Platform.OS === 'ios' ? (expoAppIntegrity.isSupported ?? false) : true;
+/** Creates a new App Attest key, stored in the Secure Enclave. @platform ios */
+export async function generateKeyAsync() {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.generateKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateKeyAsync');
+    }
+    return expoAppIntegrity.generateKeyAsync();
+}
+/** Asks Apple to attest to the validity of a key generated by `generateKeyAsync`. @platform ios */
+export async function attestKeyAsync(keyId, challenge) {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.attestKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'attestKeyAsync');
+    }
+    return expoAppIntegrity.attestKeyAsync(keyId, challenge);
+}
+/** @platform ios */
+export async function generateAssertionAsync(keyId, challenge) {
+    if (Platform.OS !== 'ios' || !expoAppIntegrity.generateAssertionAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateAssertionAsync');
+    }
+    return expoAppIntegrity.generateAssertionAsync(keyId, challenge);
+}
+/** @platform android */
+export async function prepareIntegrityTokenProviderAsync(cloudProjectNumber) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.prepareIntegrityTokenProviderAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'prepareIntegrityTokenProviderAsync');
+    }
+    return expoAppIntegrity.prepareIntegrityTokenProviderAsync(cloudProjectNumber);
+}
+/** @platform android */
+export async function requestIntegrityCheckAsync(requestHash) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.requestIntegrityCheckAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'requestIntegrityCheckAsync');
+    }
+    return expoAppIntegrity.requestIntegrityCheckAsync(requestHash);
+}
+/** @platform android, `false` off android rather than throwing */
+export async function isHardwareAttestationSupportedAsync() {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.isHardwareAttestationSupportedAsync) {
+        return false;
+    }
+    return expoAppIntegrity.isHardwareAttestationSupportedAsync();
+}
+/** Usable on GrapheneOS and other secure Android distributions. @platform android */
+export async function generateHardwareAttestedKeyAsync(keyAlias, challenge) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.generateHardwareAttestedKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateHardwareAttestedKeyAsync');
+    }
+    return expoAppIntegrity.generateHardwareAttestedKeyAsync(keyAlias, challenge);
+}
+/** Base64-encoded X.509 certificates, verify server-side. @platform android */
+export async function getAttestationCertificateChainAsync(keyAlias) {
+    if (Platform.OS !== 'android' ||
+        !expoAppIntegrity.getAttestationCertificateChainAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'getAttestationCertificateChainAsync');
+    }
+    return expoAppIntegrity.getAttestationCertificateChainAsync(keyAlias);
+}
+//# sourceMappingURL=app-integrity.js.map

package/build-ngc/core/app-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-integrity.js","sourceRoot":"","sources":["../../src/core/app-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GACtB,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEzE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;AAC7C,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,SAAiB;IAEjB,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,oBAAoB;AACpB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,SAAiB;IAEjB,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;QACtE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,gBAAgB,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,kBAA0B;IAE1B,IACE,QAAQ,CAAC,EAAE,KAAK,SAAS;QACzB,CAAC,gBAAgB,CAAC,kCAAkC,EACpD,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,kCAAkC,CACxD,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB;IAEnB,IACE,QAAQ,CAAC,EAAE,KAAK,SAAS;QACzB,CAAC,gBAAgB,CAAC,0BAA0B,EAC5C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,IACE,QAAQ,CAAC,EAAE,KAAK,SAAS;QACzB,CAAC,gBAAgB,CAAC,mCAAmC,EACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,mCAAmC,EAAE,CAAC;AAChE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,QAAgB,EAChB,SAAiB;IAEjB,IACE,QAAQ,CAAC,EAAE,KAAK,SAAS;QACzB,CAAC,gBAAgB,CAAC,gCAAgC,EAClD,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,gCAAgC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,QAAgB;IAEhB,IACE,QAAQ,CAAC,EAAE,KAAK,SAAS;QACzB,CAAC,gBAAgB,CAAC,mCAAmC,EACrD,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,mCAAmC,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC"}

package/build-ngc/core/index.d.ts

@@ -0,0 +1 @@
+export { attestKeyAsync, generateAssertionAsync, generateHardwareAttestedKeyAsync, generateKeyAsync, getAttestationCertificateChainAsync, isHardwareAttestationSupportedAsync, isSupported, prepareIntegrityTokenProviderAsync, requestIntegrityCheckAsync, } from './app-integrity';

package/build-ngc/core/index.js

@@ -0,0 +1,2 @@
+export { attestKeyAsync, generateAssertionAsync, generateHardwareAttestedKeyAsync, generateKeyAsync, getAttestationCertificateChainAsync, isHardwareAttestationSupportedAsync, isSupported, prepareIntegrityTokenProviderAsync, requestIntegrityCheckAsync, } from './app-integrity';
+//# sourceMappingURL=index.js.map

package/build-ngc/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gCAAgC,EAChC,gBAAgB,EAChB,mCAAmC,EACnC,mCAAmC,EACnC,WAAW,EACX,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC"}

package/build-ngc/core/native-module.d.ts

@@ -0,0 +1,12 @@
+export type INativeAppIntegrityModule = {
+    isSupported?: boolean;
+    generateKeyAsync?(): Promise<string>;
+    attestKeyAsync?(keyId: string, challenge: string): Promise<string>;
+    generateAssertionAsync?(keyId: string, challenge: string): Promise<string>;
+    prepareIntegrityTokenProviderAsync?(cloudProjectNumber: string): Promise<void>;
+    requestIntegrityCheckAsync?(requestHash: string): Promise<string>;
+    isHardwareAttestationSupportedAsync?(): Promise<boolean>;
+    generateHardwareAttestedKeyAsync?(keyAlias: string, challenge: string): Promise<void>;
+    getAttestationCertificateChainAsync?(keyAlias: string): Promise<string[]>;
+};
+export declare const expoAppIntegrity: INativeAppIntegrityModule;

package/build-ngc/core/native-module.js

@@ -0,0 +1,4 @@
+import { requireNativeModule } from 'expo-modules-core';
+const EXPO_APP_INTEGRITY_MODULE_NAME = 'ExpoAppIntegrity';
+export const expoAppIntegrity = requireNativeModule(EXPO_APP_INTEGRITY_MODULE_NAME);
+//# sourceMappingURL=native-module.js.map

package/build-ngc/core/native-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-module.js","sourceRoot":"","sources":["../../src/core/native-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAsB1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CACjD,8BAA8B,CAC/B,CAAC"}

package/native-link.json

@@ -0,0 +1,12 @@
+{
+  "android": {
+    "gradleProjectName": "expo-app-integrity",
+    "modules": [
+      {
+        "importPath": "expo.modules.integrity.IntegrityModule",
+        "className": "IntegrityModule",
+        "nativeName": "ExpoAppIntegrity"
+      }
+    ]
+  }
+}

package/package.json

@@ -0,0 +1,150 @@
+{
+  "name": "@symbiote-native/app-integrity",
+  "version": "0.1.0",
+  "description": "@expo/app-integrity wrapped for SymbioteNative — one framework-agnostic core, built once and reachable from the React, Vue, Svelte, Solid, and Angular adapters. Apple's App Attest, Android's Play Integrity, and Android hardware-attested key generation.",
+  "license": "MIT",
+  "keywords": [
+    "react-native",
+    "symbiote-native",
+    "app-integrity",
+    "react",
+    "vue",
+    "svelte",
+    "solid",
+    "angular",
+    "app-attest",
+    "play-integrity"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OneEyed1366/symbiote-native.git",
+    "directory": "packages/app-integrity"
+  },
+  "homepage": "https://github.com/OneEyed1366/symbiote-native/tree/master/packages/app-integrity#readme",
+  "bugs": {
+    "url": "https://github.com/OneEyed1366/symbiote-native/issues"
+  },
+  "author": "Andrey Prokopenko <psevdoproger@gmail.com>",
+  "type": "module",
+  "main": "./build/core/index.js",
+  "module": "./build/core/index.js",
+  "types": "./build/core/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./build/core/index.d.ts",
+      "default": "./build/core/index.js"
+    },
+    "./vue": {
+      "types": "./build/core/index.d.ts",
+      "default": "./build/core/index.js"
+    },
+    "./react": {
+      "types": "./build/core/index.d.ts",
+      "default": "./build/core/index.js"
+    },
+    "./svelte": {
+      "types": "./build/core/index.d.ts",
+      "default": "./build/core/index.js"
+    },
+    "./solid": {
+      "types": "./build/core/index.d.ts",
+      "default": "./build/core/index.js"
+    },
+    "./angular": {
+      "types": "./build-ngc/angular/index.d.ts",
+      "react-native": "./build-ngc/angular/index.js",
+      "default": "./src/angular/index.ts"
+    }
+  },
+  "files": [
+    "src",
+    "build",
+    "build-ngc",
+    "native-link.json",
+    "!src/**/*.test.*",
+    "!src/**/*.spec.*",
+    "!src/**/*.detox.*"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@expo/app-integrity": "57.0.2",
+    "expo-modules-core": "57.0.20"
+  },
+  "peerDependencies": {
+    "@angular/core": ">=20",
+    "@vue/runtime-core": "^3.5.13",
+    "react": ">=19.0.0",
+    "react-native": ">=0.86",
+    "solid-js": ">=1.9.0",
+    "svelte": ">=5.56.0",
+    "vue": ">=3.5.0",
+    "@symbiote-native/angular": "^3.1.3",
+    "@symbiote-native/engine": "^1.4.0",
+    "@symbiote-native/solid": "^3.0.5",
+    "@symbiote-native/react": "^3.1.0",
+    "@symbiote-native/svelte": "^3.0.5",
+    "@symbiote-native/vue": "^3.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@symbiote-native/angular": {
+      "optional": true
+    },
+    "@symbiote-native/react": {
+      "optional": true
+    },
+    "@symbiote-native/solid": {
+      "optional": true
+    },
+    "@symbiote-native/svelte": {
+      "optional": true
+    },
+    "@symbiote-native/vue": {
+      "optional": true
+    },
+    "@angular/core": {
+      "optional": true
+    },
+    "@vue/runtime-core": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "solid-js": {
+      "optional": true
+    },
+    "svelte": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@angular/compiler": "~22.0.8",
+    "@angular/compiler-cli": "~22.0.8",
+    "@angular/core": "~22.0.8",
+    "@types/node": "^26.0.0",
+    "@types/react": "^19.2.0",
+    "@vue/runtime-core": "^3.5.13",
+    "react": "19.2.3",
+    "solid-js": "^1.9.14",
+    "svelte": "^5.56.0",
+    "typescript": "~6.0.0",
+    "@symbiote-native/engine": "1.4.0",
+    "@symbiote-native/svelte": "3.0.5",
+    "@symbiote-native/react": "3.1.0",
+    "@symbiote-native/angular": "3.1.3",
+    "@symbiote-native/solid": "3.0.5",
+    "@symbiote-native/vue": "3.1.0",
+    "@symbiote-native/test-utils": "0.4.5"
+  },
+  "scripts": {
+    "typecheck": "tsc --build",
+    "clean": "rm -rf build-ngc",
+    "ng:build": "pnpm run clean && ngc -p tsconfig.angular.json",
+    "format": "prettier --write \"src/**/*.{ts,tsx}\""
+  }
+}

package/src/angular/index.ts

@@ -0,0 +1,2 @@
+// No per-instance state or event stream to wrap in an injectable service, plain re-export
+export * from '../core';

package/src/core/app-integrity.ts

@@ -0,0 +1,116 @@
+import { Platform, UnavailabilityError } from 'expo-modules-core';
+import { expoAppIntegrity } from './native-module';
+
+const NATIVE_MODULE_NAME = 'expo-app-integrity';
+
+/** @platform ios, true off ios since App Attest support has no Android/web equivalent */
+export const isSupported: boolean =
+  Platform.OS === 'ios' ? (expoAppIntegrity.isSupported ?? false) : true;
+
+/** Creates a new App Attest key, stored in the Secure Enclave. @platform ios */
+export async function generateKeyAsync(): Promise<string> {
+  if (Platform.OS !== 'ios' || !expoAppIntegrity.generateKeyAsync) {
+    throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateKeyAsync');
+  }
+  return expoAppIntegrity.generateKeyAsync();
+}
+
+/** Asks Apple to attest to the validity of a key generated by `generateKeyAsync`. @platform ios */
+export async function attestKeyAsync(
+  keyId: string,
+  challenge: string,
+): Promise<string> {
+  if (Platform.OS !== 'ios' || !expoAppIntegrity.attestKeyAsync) {
+    throw new UnavailabilityError(NATIVE_MODULE_NAME, 'attestKeyAsync');
+  }
+  return expoAppIntegrity.attestKeyAsync(keyId, challenge);
+}
+
+/** @platform ios */
+export async function generateAssertionAsync(
+  keyId: string,
+  challenge: string,
+): Promise<string> {
+  if (Platform.OS !== 'ios' || !expoAppIntegrity.generateAssertionAsync) {
+    throw new UnavailabilityError(NATIVE_MODULE_NAME, 'generateAssertionAsync');
+  }
+  return expoAppIntegrity.generateAssertionAsync(keyId, challenge);
+}
+
+/** @platform android */
+export async function prepareIntegrityTokenProviderAsync(
+  cloudProjectNumber: string,
+): Promise<void> {
+  if (
+    Platform.OS !== 'android' ||
+    !expoAppIntegrity.prepareIntegrityTokenProviderAsync
+  ) {
+    throw new UnavailabilityError(
+      NATIVE_MODULE_NAME,
+      'prepareIntegrityTokenProviderAsync',
+    );
+  }
+  return expoAppIntegrity.prepareIntegrityTokenProviderAsync(
+    cloudProjectNumber,
+  );
+}
+
+/** @platform android */
+export async function requestIntegrityCheckAsync(
+  requestHash: string,
+): Promise<string> {
+  if (
+    Platform.OS !== 'android' ||
+    !expoAppIntegrity.requestIntegrityCheckAsync
+  ) {
+    throw new UnavailabilityError(
+      NATIVE_MODULE_NAME,
+      'requestIntegrityCheckAsync',
+    );
+  }
+  return expoAppIntegrity.requestIntegrityCheckAsync(requestHash);
+}
+
+/** @platform android, `false` off android rather than throwing */
+export async function isHardwareAttestationSupportedAsync(): Promise<boolean> {
+  if (
+    Platform.OS !== 'android' ||
+    !expoAppIntegrity.isHardwareAttestationSupportedAsync
+  ) {
+    return false;
+  }
+  return expoAppIntegrity.isHardwareAttestationSupportedAsync();
+}
+
+/** Usable on GrapheneOS and other secure Android distributions. @platform android */
+export async function generateHardwareAttestedKeyAsync(
+  keyAlias: string,
+  challenge: string,
+): Promise<void> {
+  if (
+    Platform.OS !== 'android' ||
+    !expoAppIntegrity.generateHardwareAttestedKeyAsync
+  ) {
+    throw new UnavailabilityError(
+      NATIVE_MODULE_NAME,
+      'generateHardwareAttestedKeyAsync',
+    );
+  }
+  return expoAppIntegrity.generateHardwareAttestedKeyAsync(keyAlias, challenge);
+}
+
+/** Base64-encoded X.509 certificates, verify server-side. @platform android */
+export async function getAttestationCertificateChainAsync(
+  keyAlias: string,
+): Promise<string[]> {
+  if (
+    Platform.OS !== 'android' ||
+    !expoAppIntegrity.getAttestationCertificateChainAsync
+  ) {
+    throw new UnavailabilityError(
+      NATIVE_MODULE_NAME,
+      'getAttestationCertificateChainAsync',
+    );
+  }
+  return expoAppIntegrity.getAttestationCertificateChainAsync(keyAlias);
+}

package/src/core/index.ts

@@ -0,0 +1,11 @@
+export {
+  attestKeyAsync,
+  generateAssertionAsync,
+  generateHardwareAttestedKeyAsync,
+  generateKeyAsync,
+  getAttestationCertificateChainAsync,
+  isHardwareAttestationSupportedAsync,
+  isSupported,
+  prepareIntegrityTokenProviderAsync,
+  requestIntegrityCheckAsync,
+} from './app-integrity';

package/src/core/native-module.ts

@@ -0,0 +1,27 @@
+import { requireNativeModule } from 'expo-modules-core';
+
+const EXPO_APP_INTEGRITY_MODULE_NAME = 'ExpoAppIntegrity';
+
+// The App Attest trio and `isSupported` exist only on iOS, the Play Integrity/hardware-attestation
+// methods only on Android, so app-integrity.ts checks Platform.OS before calling through, same
+// convention as packages/application/src/core/native-module.ts
+export type INativeAppIntegrityModule = {
+  isSupported?: boolean;
+  generateKeyAsync?(): Promise<string>;
+  attestKeyAsync?(keyId: string, challenge: string): Promise<string>;
+  generateAssertionAsync?(keyId: string, challenge: string): Promise<string>;
+  prepareIntegrityTokenProviderAsync?(
+    cloudProjectNumber: string,
+  ): Promise<void>;
+  requestIntegrityCheckAsync?(requestHash: string): Promise<string>;
+  isHardwareAttestationSupportedAsync?(): Promise<boolean>;
+  generateHardwareAttestedKeyAsync?(
+    keyAlias: string,
+    challenge: string,
+  ): Promise<void>;
+  getAttestationCertificateChainAsync?(keyAlias: string): Promise<string[]>;
+};
+
+export const expoAppIntegrity = requireNativeModule<INativeAppIntegrityModule>(
+  EXPO_APP_INTEGRITY_MODULE_NAME,
+);