unified-ble-manager 4.0.2 → 4.0.4

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to `unified-ble-manager` are documented here.
 
 ## [Unreleased]
 
+## [4.0.4] - 2026-08-25
+
+Post-4.0.3 audit: wire/scan/IPC ownership, Android 16 KB ELF alignment, Apple teardown, abortable Web chooser honesty, React remount-owned cleanup, and React Native entropy without WebCrypto. Does not retag `v4.0.3`.
+
+### Fixes
+
+- Tauri wire codec budgets, public scan presence overflow, IPC contract errors, GATT admission/rediscovery, Android scanCallback/receiver commit-after-success, 16 KB native page size (#80, #81, #83, #84, #93, #85, #86, #100, #107).
+- Apple disconnect confirmation, Service Changed CCCD retry, restored notify-off; Web chooser abort/timeout does not retain a late `requestDevice` grant (#87, #89, #90, #88).
+- React adapter-watch fail-visible terminals, remount-owned scan/characteristic `release-failed`, scoped BleProvider barriers, composeAbortSignal listener cleanup, `managerKey` replacement (#96, #97, #98, #99, #101).
+- React Native manager construction no longer depends on WebCrypto or a Metro-fatal `crypto` require; native CSPRNG is the default, with injectable `randomBytes` (#111, #113, #114).
+
+### Release integrity
+
+- Cut from the exact post-PR #110 `main` merge commit through the tag-driven trusted-publishing workflow.
+- Intended for publication as `latest`; this does not promote backend support labels or claim physical-radio evidence.
+
+## [4.0.3] - 2026-08-25
+
+Lifecycle ownership is explicit through clone/decode, public stream close, IPC admission, Web/Tauri teardown, backend unregister/overflow native release, and React hook store/terminal cleanup. Does not retag `v4.0.2`.
+
+### Fixes
+
+- Serializable clone/decode stays fail-closed; public stream close, scan stop, and IPC/Web/Tauri teardown no longer drop `release-failed` or skip native disconnect (#58, #59, #75, #60, #72, #63, #73, #76, #74, #79, #67, #77, #78).
+- Adapter, security, and event-stream close/overflow keep backend ownership until native release succeeds; overflowing CoreBluetooth scan owners do not stop remaining joiners (#61, #68, #69, #70, #71).
+- React adapter-state watches cannot wedge or double-own a run; `useDiscoveredPeers` is bounded and honors lost-peer events; connection and characteristic hooks leave loading with a fail-visible terminal (#62, #65, #66).
+
+### Release integrity
+
+- Cut from the exact post-PR #105 `main` merge commit through the tag-driven trusted-publishing workflow.
+- Intended for publication as `latest`; this does not promote backend support labels or claim physical-radio evidence.
+
 ## [4.0.2] - 2026-08-24
 
 Public coalesced scans no longer lose duplicate suppression after lost-peer or presence-cap churn: fingerprint deletions now decrement the retained-byte counter. IPC pre-registration buffering is globally bounded (ID/item/byte/age) with fail-visible tombstones. Connection release attempts `connection.disconnect` even when lifecycle unsubscribe rejects or returns `release-failed`, and preserves both cleanup failures. Does not retag `v4.0.1`.

package/MIGRATION_4.0.md

@@ -2,7 +2,7 @@
 
 # Migrating from react-native-ble-plx
 
-The current package is `4.0.2`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
+The current package is `4.0.4`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
 
 This page is for a React Native app that already uses `react-native-ble-plx`. Web, Electron, Node, and Tauri are new hosts — use those pages after you understand the RN rewrite.
 

package/README.md

@@ -6,7 +6,7 @@
 
 It is an evolution of `react-native-ble-plx`, rewritten as a **cross-platform unified product**. One bytes-first BLE model and lifecycle semantics across hosts, with host-specific construction and ownership. The root package never picks a radio for you, and it will not quietly fall back to a simulator or a different backend.
 
-Install `unified-ble-manager` from npm (`4.0.2` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
+Install `unified-ble-manager` from npm (`4.0.4` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
 
 > Sponsored by [Imagi Explain](https://imagiexplain.com) — researched, narrated whiteboard explainers from a prompt, a PDF, or your notes.
 
@@ -279,6 +279,7 @@ after disconnect, service change, or rediscovery.
 | `createElectronRendererBleManager` / `createElectronRendererBleManagerWithEnvironment` | Public renderer `BleManager` over a preload transport; the renderer never loads a radio backend |
 | `createTauriBleManager`                                                                | Zero-plumbing Tauri `BleManager`; tests use `createTauriBleManagerWithEnvironment`              |
 | `createBleManagerFromProvider`                                                         | Advanced provider construction                                                                  |
+| `createPublicBleManagerFacade`                                                         | Projects an already-owned `/advanced` manager into the root public `BleManager`; creates no advanced manager, backend, or radio |
 
 ## Other hosts
 

package/RELEASE.md

@@ -81,7 +81,7 @@ Active `4.0.0-rc.*` release-train candidates publish to npm `latest` so a bare `
 
 On release day, set `release_candidate` to the exact candidate required by the
 release plan. RC2, RC3, RC4, `4.0.0-rc.4.1`, and RC5 are already immutable
-once tagged. Stable `4.0.0` and `4.0.1` are immutable. `4.0.2` is the current train head.
+once tagged. Stable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` are immutable. `4.0.4` is the current train head.
 
 ```sh
 release_candidate=4.0.0-rc.N
@@ -119,7 +119,23 @@ git tag -a v4.0.1 -m "v4.0.1"
 
 ## Releasing 4.0.2
 
-The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0` or `v4.0.1`.
+The `v4.0.2` tag is immutable published history. Do not recreate or move it.
+
+```sh
+git tag -a v4.0.2 -m "v4.0.2"
+```
+
+## Releasing 4.0.3
+
+The `v4.0.3` tag is immutable published history. Do not recreate or move it.
+
+```sh
+git tag -a v4.0.3 -m "v4.0.3"
+```
+
+## Releasing 4.0.4
+
+The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0`, `v4.0.1`, `v4.0.2`, or `v4.0.3`.
 
 On release day:
 
@@ -129,12 +145,12 @@ git checkout main
 git pull --ff-only origin main
 
 test "$(git branch --show-current)" = "main"
-test "$(node -p "require('./package.json').version")" = "4.0.2"
+test "$(node -p "require('./package.json').version")" = "4.0.4"
 git diff --exit-code
 git diff --cached --exit-code
 
-git tag -a v4.0.2 -m "v4.0.2"
-git push origin v4.0.2
+git tag -a v4.0.4 -m "v4.0.4"
+git push origin v4.0.4
 ```
 
 Do not push another commit to `main` between the final verification and the tag push.

package/SBOM.cdx.json

@@ -6,15 +6,15 @@
   "metadata": {
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/unified-ble-manager@4.0.2",
+      "bom-ref": "pkg:npm/unified-ble-manager@4.0.4",
       "name": "unified-ble-manager",
-      "version": "4.0.2",
+      "version": "4.0.4",
       "licenses": [
         {
           "expression": "Apache-2.0"
         }
       ],
-      "purl": "pkg:npm/unified-ble-manager@4.0.2"
+      "purl": "pkg:npm/unified-ble-manager@4.0.4"
     },
     "properties": [
       {
@@ -537,7 +537,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/unified-ble-manager@4.0.2",
+      "ref": "pkg:npm/unified-ble-manager@4.0.4",
       "dependsOn": [
         "pkg:npm/%40tauri-apps/api@2.11.1",
         "pkg:npm/node-addon-api@8.9.0",

package/THIRD_PARTY_LICENSES.json

@@ -4,7 +4,7 @@
   "schemaVersion": "1.0.0",
   "package": {
     "name": "unified-ble-manager",
-    "version": "4.0.2"
+    "version": "4.0.4"
   },
   "source": {
     "method": "pnpm-lock production graph with installed-manifest license audit",

package/android/build.gradle

@@ -41,6 +41,8 @@ def supportsNamespace() {
 }
 
 android {
+  ndkVersion rootProject.ext.has("ndkVersion") ? rootProject.ext.ndkVersion : "27.1.12297006"
+
   if (supportsNamespace()) {
     namespace = "com.sfourdrinier.unifiedblemanager"
 

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/protocol/UnifiedBleProtocolControlModule.java

@@ -453,6 +453,22 @@ public final class UnifiedBleProtocolControlModule extends NativeUnifiedBleProto
     }
   }
 
+  @Override
+  public void getRandomBytes(double length, Promise promise) {
+    final int n = (int) length;
+    if (n != length || n <= 0 || n > 1024) {
+      promise.reject("argument.invalid", "randomBytes.length");
+      return;
+    }
+    final byte[] out = new byte[n];
+    new java.security.SecureRandom().nextBytes(out);
+    final com.facebook.react.bridge.WritableArray values = Arguments.createArray();
+    for (byte value : out) {
+      values.pushInt(value & 0xff);
+    }
+    promise.resolve(values);
+  }
+
   @Override
   public synchronized void installExecutionRuntime(Promise promise) {
     try {

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/radio/OwnedAndroidGattRadio.kt

@@ -349,7 +349,6 @@ class OwnedAndroidGattRadio(private val context: Context) {
           onAdapterState?.invoke(mapAdapterState(state))
         }
       }
-    adapterStateReceiver = receiver
     val filter = IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED)
     // System broadcast (ACTION_STATE_CHANGED) requires RECEIVER_EXPORTED on API 33+.
     if (Build.VERSION.SDK_INT >= 33) {
@@ -358,6 +357,7 @@ class OwnedAndroidGattRadio(private val context: Context) {
       @Suppress("UnspecifiedRegisterReceiverFlag")
       context.registerReceiver(receiver, filter)
     }
+    adapterStateReceiver = receiver
   }
 
   internal fun unregisterAdapterStateReceiver(): OwnedRadioTeardownFailure? {
@@ -444,11 +444,30 @@ class OwnedAndroidGattRadio(private val context: Context) {
         onScanFailed?.invoke(errorCode)
       }
     }
-    scanCallback = cb
-    if (filters.isEmpty()) {
-      scanner?.startScan(null, settings, cb)
-    } else {
-      scanner?.startScan(filters, settings, cb)
+    try {
+      if (filters.isEmpty()) {
+        scanner?.startScan(null, settings, cb)
+      } else {
+        scanner?.startScan(filters, settings, cb)
+      }
+      scanCallback = cb
+    } catch (error: Throwable) {
+      val cleanupFailure =
+        try {
+          scanner?.stopScan(cb)
+          null
+        } catch (stopError: Throwable) {
+          OwnedAndroidLog.e("startScan compensating stopScan", stopError)
+          stopError
+        }
+      if (cleanupFailure == null) {
+        scanCallback = null
+        scanner = null
+        scanSeenDeviceIds.clear()
+      } else {
+        scanCallback = cb
+      }
+      throw error
     }
   }
 
@@ -612,13 +631,13 @@ class OwnedAndroidGattRadio(private val context: Context) {
         }
       }
     }
-    bondStateReceiver = receiver
     val filter = IntentFilter(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
     if (Build.VERSION.SDK_INT >= 33) context.registerReceiver(receiver, filter, Context.RECEIVER_EXPORTED)
     else {
       @Suppress("UnspecifiedRegisterReceiverFlag")
       context.registerReceiver(receiver, filter)
     }
+    bondStateReceiver = receiver
   }
 
   internal fun unregisterBondStateReceiver(): OwnedRadioTeardownFailure? {

package/android/src/main/jni/CMakeLists.txt

@@ -48,3 +48,10 @@ target_compile_options(
   -Wextra
   -Werror
 )
+
+target_link_options(
+  ${CMAKE_PROJECT_NAME}
+  PRIVATE
+  "-Wl,-z,max-page-size=16384"
+  "-Wl,-z,common-page-size=16384"
+)

package/docs/ELECTRON.md

@@ -4,7 +4,7 @@
 
 Main owns the radio. The renderer uses a versioned IPC client and never loads a native addon.
 
-The current package is `4.0.2`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
+The current package is `4.0.4`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
 
 `unified-ble-manager/electron/main` and
 `unified-ble-manager/electron/renderer` are the only Electron entrypoints.

package/docs/EXPO_PLUGIN.md

@@ -7,7 +7,7 @@ start a radio, request runtime permissions during prebuild, or prove physical
 radio/restoration reliability. Expo Go is not a supported BLE execution
 environment because it cannot contain this native module.
 
-Use the v2 plugin options in the published `4.0.2` package. Those options match
+Use the v2 plugin options in the published `4.0.4` package. Those options match
 the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 
 ## Installation and development build
@@ -15,7 +15,7 @@ the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 Pin the package so a later `latest` bump does not change native plugin options
 without a rebuild:
 
-    pnpm add unified-ble-manager@4.0.2
+    pnpm add unified-ble-manager@4.0.4
     pnpm add expo@^57.0.0 expo-dev-client
     npx expo prebuild --clean
     npx expo run:ios

package/docs/GAPS.4.0.md

@@ -14,7 +14,7 @@ This file tracks platform code, CI, package, lab, and live-radio evidence. It do
 
 The clean-baseline contract, unified core, public manager, deterministic backend, TCK, native protocol, first-party backend implementations, host-isolated package exports, SDK/CLI, and legacy-absence gates exist in the 4.0 source. Passing deterministic, compile, ABI, or package tests are implementation proof; they do not become physical-radio support evidence unless a retained record proves the corresponding live scenario.
 
-`unified-ble-manager@4.0.2` is the published, immutable stable package/API. Immutable `4.0.0` and `4.0.1` remain published history. Backend support labels remain
+`unified-ble-manager@4.0.4` is the published, immutable stable package/API. Immutable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` remain published history. Backend support labels remain
 evidence-derived. This package does not rewrite the evidence inventory: a backend remains at the support level
 justified by its records. The alpha train, including `v4.0.0-alpha.40`, remains historical implementation/release
 evidence and must not be used to claim a higher current support label than it actually proved.

package/docs/GETTING_STARTED.md

@@ -4,7 +4,7 @@
 
 This page gets you to a first scan, connect, read, notify, and teardown on React Native. Other hosts are linked at the bottom. The root import does not turn Bluetooth on.
 
-The current package is `4.0.2`.
+The current package is `4.0.4`.
 
 ## Pick a host
 
@@ -27,7 +27,7 @@ The current package is `4.0.2`.
 Pin the current package for a known native rebuild:
 
 ```sh
-pnpm add unified-ble-manager@4.0.2
+pnpm add unified-ble-manager@4.0.4
 ```
 
 Declare Android Bluetooth permissions and the BLE hardware feature yourself,
@@ -37,10 +37,10 @@ request runtime permissions on Android 12+, add
 #### Expo / CNG v2
 
 The Expo v2 schema and `unified-ble-manager/expo` factory are in the published
-`4.0.2` package. Pin that exact version:
+`4.0.4` package. Pin that exact version:
 
 ```sh
-pnpm add unified-ble-manager@4.0.2
+pnpm add unified-ble-manager@4.0.4
 ```
 
 The package does not run in Expo Go.

package/docs/NODE.md

@@ -10,7 +10,7 @@ The root import does not open an adapter. Pick one backend:
 | `unified-ble-manager/node/winrt`         | Windows                                      |
 | `unified-ble-manager/node/bluez`         | Linux (needs `dbus-next@^0.10.2` in the app) |
 
-The current package is `4.0.2`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
+The current package is `4.0.4`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
 
 ## One-call factories
 

package/docs/PLATFORMS.md

@@ -8,7 +8,7 @@ This page is an evidence index, not a static compatibility matrix. An applicatio
 
 ## Package stability and backend support are separate
 
-`unified-ble-manager@4.0.2` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0` and `4.0.1` remain published history.
+`unified-ble-manager@4.0.4` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` remain published history.
 
 This package is the portable API/semantics freeze; it does **not** mean every first-party backend is
 automatically Preview, Supported, or Reliability-qualified.

package/docs/WEB.md

@@ -4,7 +4,7 @@
 
 Use `unified-ble-manager/web` in a secure context (HTTPS or localhost) from a user gesture. There is no background scan and no process-level restoration.
 
-The current package is `4.0.2`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
+The current package is `4.0.4`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
 
 ## Create the manager
 

package/docs/generated/PLATFORM_SUPPORT.md

@@ -6,7 +6,7 @@ This page is generated by `scripts/docs/generate-platform-support.js` from valid
 
 ## Current package
 
-`unified-ble-manager@4.0.2`
+`unified-ble-manager@4.0.4`
 
 No evidence record is bound to this exact package version and artifact. Consequently, this generated page makes no Preview, Live Preview, Supported, or Reliability-qualified platform claim for the current package.
 

package/ios/Owned/OwnedCoreBluetoothProtocolRadio.swift

@@ -56,9 +56,9 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
   /// retained cleanup entry, rather than an unbounded timer fan-out, is the
   /// source of truth for the physical CCCD transition still in flight.
   var pendingCancellationCleanupRetryScheduled = Set<String>()
-  private var subscriptions = [CharacteristicAddress: String]()
+  var subscriptions = [CharacteristicAddress: String]()
   var activeScanOperationIdentifier: String?
-  private var restoredPeerIdentifiers = [String]()
+  var restoredPeerIdentifiers = [String]()
   var destroyed = false
 
   struct CharacteristicAddress: Hashable {
@@ -158,17 +158,14 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
       self.failAllPendingOperationsOnDestroy()
       self.pendingCancellationCleanup.removeAll()
       self.pendingCancellationCleanupRetryScheduled.removeAll()
+      self.disableActiveNotifications()
       self.subscriptions.removeAll()
       let restoredIdentifiers = Set(self.restoredPeerIdentifiers)
-      for (identifier, peripheral) in self.peripheralByIdentifier where !restoredIdentifiers.contains(identifier) {
-        if peripheral.state == .connected || peripheral.state == .connecting {
-          self.central.cancelPeripheralConnection(peripheral)
-        }
-        peripheral.delegate = nil
-      }
-      self.peripheralByIdentifier = self.peripheralByIdentifier.filter { restoredIdentifiers.contains($0.key) }
-      self.servicesByPeer = self.servicesByPeer.filter { restoredIdentifiers.contains($0.key) }
-      completion(nil)
+      self.completeAfterPendingDisconnects(
+        preserving: restoredIdentifiers,
+        destroyRadio: false,
+        completion: completion
+      )
     }
   }
 
@@ -450,17 +447,14 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
       self.destroyed = true
       self.central.stopScan()
       self.activeScanOperationIdentifier = nil
-      for peripheral in self.peripheralByIdentifier.values where peripheral.state == .connected || peripheral.state == .connecting {
-        self.central.cancelPeripheralConnection(peripheral)
-        peripheral.delegate = nil
-      }
       self.failAllPendingOperationsOnDestroy()
+      self.disableActiveNotifications()
       self.subscriptions.removeAll()
-      self.servicesByPeer.removeAll()
-      self.peripheralByIdentifier.removeAll()
-      self.restoredPeerIdentifiers.removeAll()
-      self.central.delegate = nil
-      completion(nil)
+      self.completeAfterPendingDisconnects(
+        preserving: [],
+        destroyRadio: true,
+        completion: completion
+      )
     }
   }
 

package/ios/Owned/OwnedCoreBluetoothProtocolRadioCancellation.swift

@@ -209,4 +209,91 @@ extension OwnedCoreBluetoothProtocolRadio {
       _ = self.retryCancellationCleanupOnQueue(operationIdentifier)
     }
   }
+
+  func disableActiveNotifications() {
+    for address in subscriptions.keys {
+      if let resolved = resolve(address) {
+        resolved.peripheral.setNotifyValue(false, for: resolved.characteristic)
+      }
+    }
+  }
+
+  func completeAfterPendingDisconnects(
+    preserving restoredIdentifiers: Set<String>,
+    destroyRadio: Bool,
+    completion: @escaping (NSError?) -> Void
+  ) {
+    final class DisconnectWaiter {
+      var remaining: Int
+      var finished = false
+      let finish: (NSError?) -> Void
+      init(remaining: Int, finish: @escaping (NSError?) -> Void) {
+        self.remaining = remaining
+        self.finish = finish
+      }
+      func decrement() {
+        remaining -= 1
+        if remaining <= 0 { complete(nil) }
+      }
+      func complete(_ error: NSError?) {
+        guard !finished else { return }
+        finished = true
+        finish(error)
+      }
+    }
+
+    let waited: [(identifier: String, peripheral: CBPeripheral)] = peripheralByIdentifier.compactMap { identifier, peripheral in
+      guard !restoredIdentifiers.contains(identifier) else { return nil }
+      if peripheral.state == .connected || peripheral.state == .connecting || peripheral.state == .disconnecting {
+        return (identifier, peripheral)
+      }
+      peripheral.delegate = nil
+      return nil
+    }
+    let waiter = DisconnectWaiter(remaining: waited.count) { [weak self] error in
+      guard let self else {
+        completion(error)
+        return
+      }
+      for (identifier, peripheral) in self.peripheralByIdentifier where !restoredIdentifiers.contains(identifier) {
+        peripheral.delegate = nil
+      }
+      if destroyRadio {
+        for peripheral in self.peripheralByIdentifier.values {
+          peripheral.delegate = nil
+        }
+        self.peripheralByIdentifier.removeAll()
+        self.servicesByPeer.removeAll()
+        self.restoredPeerIdentifiers.removeAll()
+        self.central.delegate = nil
+      } else {
+        self.peripheralByIdentifier = self.peripheralByIdentifier.filter { restoredIdentifiers.contains($0.key) }
+        self.servicesByPeer = self.servicesByPeer.filter { restoredIdentifiers.contains($0.key) }
+      }
+      completion(error)
+    }
+    if waited.isEmpty {
+      waiter.complete(nil)
+      return
+    }
+    queue.asyncAfter(deadline: .now() + .seconds(5)) { [weak self] in
+      guard let self else { return }
+      waiter.complete(self.error(code: 1026, message: "CoreBluetooth disconnect confirmation timed out"))
+    }
+    for entry in waited {
+      let previous = pendingDisconnect[entry.identifier]
+      pendingDisconnect[entry.identifier] = PendingVoid(operationIdentifier: "teardown-\(entry.identifier)") { error in
+        previous?.completion(error)
+        waiter.decrement()
+      }
+      if entry.peripheral.state == .disconnected {
+        pendingDisconnect.removeValue(forKey: entry.identifier)?.completion(nil)
+        continue
+      }
+      central.cancelPeripheralConnection(entry.peripheral)
+      if entry.peripheral.state == .disconnected {
+        pendingDisconnect.removeValue(forKey: entry.identifier)?.completion(nil)
+      }
+    }
+  }
 }

package/ios/UnifiedBleProtocolControl.mm

@@ -2,6 +2,7 @@
 
 #import <Foundation/Foundation.h>
 #import <CoreBluetooth/CoreBluetooth.h>
+#import <Security/Security.h>
 #import <React/RCTLog.h>
 #import <ReactCommon/RCTTurboModule.h>
 #import <ReactCommon/RCTTurboModuleWithJSIBindings.h>
@@ -12,6 +13,7 @@
 #endif
 
 #include <cmath>
+#include <vector>
 #include "../native/protocol/include/NativeProtocolControlRuntime.hpp"
 #include "../native/protocol/include/NativeRestorationConfiguration.hpp"
 #include "NativeProtocol/UnifiedBleProtocolAppleExecution.hpp"
@@ -516,6 +518,26 @@ RCT_EXPORT_MODULE(UnifiedBleProtocolControl)
   });
 }
 
+- (void)getRandomBytes:(double)length
+               resolve:(RCTPromiseResolveBlock)resolve
+                reject:(RCTPromiseRejectBlock)reject {
+  const int n = static_cast<int>(length);
+  if (length != static_cast<double>(n) || n <= 0 || n > 1024) {
+    rejectControl(reject, @"argument.invalid", @"randomBytes.length");
+    return;
+  }
+  std::vector<uint8_t> bytes(static_cast<size_t>(n));
+  if (SecRandomCopyBytes(kSecRandomDefault, static_cast<size_t>(n), bytes.data()) != errSecSuccess) {
+    rejectControl(reject, @"capability.unsupported", @"host-identity.secure-randomness");
+    return;
+  }
+  NSMutableArray<NSNumber *> *values = [NSMutableArray arrayWithCapacity:static_cast<NSUInteger>(n)];
+  for (int index = 0; index < n; index += 1) {
+    [values addObject:@(bytes[static_cast<size_t>(index)])];
+  }
+  resolve(values);
+}
+
 - (void)installExecutionRuntime:(RCTPromiseResolveBlock)resolve
                          reject:(RCTPromiseRejectBlock)reject {
   if (_attachment == nil) {

package/lib/commonjs/NativeUnifiedBleProtocolControl.js.map

@@ -1 +1 @@
-{"version":3,"names":["_reactNative","require","_default","exports","default","TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeUnifiedBleProtocolControl.ts"],"mappings":";;;;;;AAGA,IAAAA,YAAA,GAAAC,OAAA;AAHA;AAAA,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAkKeC,gCAAmB,CAACC,YAAY,CAAO,2BAA2B,CAAC","ignoreList":[]}
+{"version":3,"names":["_reactNative","require","_default","exports","default","TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeUnifiedBleProtocolControl.ts"],"mappings":";;;;;;AAGA,IAAAA,YAAA,GAAAC,OAAA;AAHA;AAAA,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAoKeC,gCAAmB,CAACC,YAAY,CAAO,2BAA2B,CAAC","ignoreList":[]}