@capgo/capacitor-device-integrity 8.0.2

package/dist/esm/definitions.js

@@ -0,0 +1,3 @@
+/// <reference types="@capacitor/cli" />
+export {};
+//# sourceMappingURL=definitions.js.map

package/dist/esm/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"AAAA,wCAAwC","sourcesContent":["/// <reference types=\"@capacitor/cli\" />\n\ndeclare module '@capacitor/cli' {\n  export interface PluginsConfig {\n    /**\n     * Device Integrity plugin configuration.\n     */\n    DeviceIntegrity?: DeviceIntegrityPluginConfig;\n  }\n}\n\n/**\n * Capacitor config for the Device Integrity plugin.\n */\nexport interface DeviceIntegrityPluginConfig {\n  /**\n   * Android only. Google Cloud project number used by the Play Integrity Standard API.\n   *\n   * Example:\n   * `plugins.DeviceIntegrity.cloudProjectNumber = '123456789012'`\n   */\n  cloudProjectNumber?: string;\n}\n\nexport type DeviceIntegrityPlatform = 'android' | 'ios' | 'web';\n\nexport type AttestationFormat = 'apple-app-attest' | 'google-play-integrity-standard';\n\nexport interface DeviceIntegrityPlugin {\n  /**\n   * Returns the native integrity capabilities available on the current platform.\n   */\n  getCapabilities(): Promise<DeviceIntegrityCapabilities>;\n\n  /**\n   * Returns an Android Widevine-derived fingerprint.\n   *\n   * The default `fingerprint` is SHA-256 over the Widevine device unique ID and a salt.\n   * If `hashSalt` is not provided, Android uses the app package name as the salt.\n   *\n   * The raw Widevine ID is sensitive and is only returned as base64 when `includeRawId` is true.\n   */\n  getWidevineFingerprint(options?: WidevineFingerprintOptions): Promise<WidevineFingerprintResult>;\n\n  /**\n   * Prepares native attestation state and returns the key/provider handle.\n   *\n   * iOS: creates an App Attest key.\n   * Android: prepares a Play Integrity Standard token provider.\n   */\n  prepareAttestation(options?: PrepareAttestationOptions): Promise<PrepareAttestationResult>;\n\n  /**\n   * Creates a registration attestation token bound to a backend-issued challenge.\n   */\n  createAttestation(options: CreateAttestationOptions): Promise<AttestationTokenResult>;\n\n  /**\n   * Creates a request assertion token bound to a request payload.\n   */\n  createAssertion(options: CreateAssertionOptions): Promise<AttestationTokenResult>;\n\n  /**\n   * Creates an iOS DeviceCheck token for server-side fraud-state lookups.\n   */\n  getDeviceCheckToken(): Promise<DeviceCheckTokenResult>;\n}\n\nexport interface DeviceIntegrityCapabilities {\n  /**\n   * Platform currently executing the plugin.\n   */\n  platform: DeviceIntegrityPlatform;\n\n  /**\n   * Android Widevine DRM support.\n   */\n  widevine: WidevineCapabilities;\n\n  /**\n   * iOS App Attest support.\n   */\n  appAttest: SupportStatus;\n\n  /**\n   * iOS DeviceCheck support.\n   */\n  deviceCheck: SupportStatus;\n\n  /**\n   * Android Play Integrity support.\n   */\n  playIntegrity: SupportStatus;\n}\n\nexport interface WidevineCapabilities {\n  /**\n   * Whether the Widevine DRM scheme is supported by the device.\n   */\n  supported: boolean;\n\n  /**\n   * Whether the Widevine device unique ID can be read.\n   */\n  fingerprintAvailable: boolean;\n\n  /**\n   * Whether the Widevine security level property can be read.\n   */\n  securityLevelScanSupported: boolean;\n}\n\nexport interface SupportStatus {\n  /**\n   * Whether the capability is available on the current device.\n   */\n  supported: boolean;\n}\n\nexport interface WidevineFingerprintOptions {\n  /**\n   * Return the raw Widevine device unique ID as base64.\n   *\n   * Defaults to `false`.\n   */\n  includeRawId?: boolean;\n\n  /**\n   * Optional salt used to derive `fingerprint`.\n   *\n   * Android uses the app package name when omitted.\n   */\n  hashSalt?: string;\n}\n\nexport interface WidevineFingerprintResult {\n  /**\n   * Always `android`.\n   */\n  platform: 'android';\n\n  /**\n   * Always `widevine`.\n   */\n  source: 'widevine';\n\n  /**\n   * Salted SHA-256 fingerprint for storing alongside a user record.\n   */\n  fingerprint: string;\n\n  /**\n   * Unsalted SHA-256 hash of the Widevine device unique ID.\n   */\n  widevineIdSha256: string;\n\n  /**\n   * Raw Widevine device unique ID encoded as base64.\n   *\n   * Returned only when `includeRawId` is true.\n   */\n  widevineIdBase64?: string;\n\n  /**\n   * Widevine security level when available, for example `L1` or `L3`.\n   */\n  securityLevel?: string;\n\n  /**\n   * DRM vendor when available.\n   */\n  vendor?: string;\n\n  /**\n   * DRM plugin version when available.\n   */\n  version?: string;\n\n  /**\n   * DRM plugin description when available.\n   */\n  description?: string;\n}\n\nexport interface PrepareAttestationOptions {\n  /**\n   * Android only. Google Cloud project number for Play Integrity.\n   *\n   * Can be configured globally via `plugins.DeviceIntegrity.cloudProjectNumber`.\n   */\n  cloudProjectNumber?: string;\n}\n\nexport interface PrepareAttestationResult {\n  /**\n   * iOS App Attest key ID or Android Play Integrity provider handle ID.\n   */\n  keyId: string;\n\n  /**\n   * Native attestation format used by the current platform.\n   */\n  format: AttestationFormat;\n}\n\nexport interface CreateAttestationOptions {\n  /**\n   * Key/provider handle returned from `prepareAttestation()`.\n   */\n  keyId: string;\n\n  /**\n   * Backend-issued one-time challenge.\n   */\n  challenge: string;\n\n  /**\n   * Android only. Google Cloud project number for Play Integrity.\n   */\n  cloudProjectNumber?: string;\n}\n\nexport interface CreateAssertionOptions {\n  /**\n   * Key/provider handle returned from `prepareAttestation()`.\n   */\n  keyId: string;\n\n  /**\n   * Backend-issued one-time request payload or nonce.\n   */\n  payload: string;\n\n  /**\n   * Android only. Google Cloud project number for Play Integrity.\n   */\n  cloudProjectNumber?: string;\n}\n\nexport interface AttestationTokenResult {\n  /**\n   * Token/assertion that must be verified server-side.\n   */\n  token: string;\n\n  /**\n   * Key/provider handle used to create the token.\n   */\n  keyId: string;\n\n  /**\n   * Native attestation format used by the current platform.\n   */\n  format: AttestationFormat;\n}\n\nexport interface DeviceCheckTokenResult {\n  /**\n   * iOS DeviceCheck token encoded as base64.\n   */\n  token: string;\n}\n"]}

package/dist/esm/index.d.ts

@@ -0,0 +1,4 @@
+import type { DeviceIntegrityPlugin } from './definitions';
+declare const DeviceIntegrity: DeviceIntegrityPlugin;
+export * from './definitions';
+export { DeviceIntegrity };

package/dist/esm/index.js

@@ -0,0 +1,7 @@
+import { registerPlugin } from '@capacitor/core';
+const DeviceIntegrity = registerPlugin('DeviceIntegrity', {
+    web: () => import('./web').then((m) => new m.DeviceIntegrityWeb()),
+});
+export * from './definitions';
+export { DeviceIntegrity };
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,eAAe,GAAG,cAAc,CAAwB,iBAAiB,EAAE;IAC/E,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,CAAC","sourcesContent":["import { registerPlugin } from '@capacitor/core';\n\nimport type { DeviceIntegrityPlugin } from './definitions';\n\nconst DeviceIntegrity = registerPlugin<DeviceIntegrityPlugin>('DeviceIntegrity', {\n  web: () => import('./web').then((m) => new m.DeviceIntegrityWeb()),\n});\n\nexport * from './definitions';\nexport { DeviceIntegrity };\n"]}

package/dist/esm/web.d.ts

@@ -0,0 +1,10 @@
+import { WebPlugin } from '@capacitor/core';
+import type { AttestationTokenResult, CreateAssertionOptions, CreateAttestationOptions, DeviceCheckTokenResult, DeviceIntegrityCapabilities, DeviceIntegrityPlugin, PrepareAttestationOptions, PrepareAttestationResult, WidevineFingerprintOptions, WidevineFingerprintResult } from './definitions';
+export declare class DeviceIntegrityWeb extends WebPlugin implements DeviceIntegrityPlugin {
+    getCapabilities(): Promise<DeviceIntegrityCapabilities>;
+    getWidevineFingerprint(_options?: WidevineFingerprintOptions): Promise<WidevineFingerprintResult>;
+    prepareAttestation(_options?: PrepareAttestationOptions): Promise<PrepareAttestationResult>;
+    createAttestation(_options: CreateAttestationOptions): Promise<AttestationTokenResult>;
+    createAssertion(_options: CreateAssertionOptions): Promise<AttestationTokenResult>;
+    getDeviceCheckToken(): Promise<DeviceCheckTokenResult>;
+}

package/dist/esm/web.js

@@ -0,0 +1,37 @@
+import { WebPlugin } from '@capacitor/core';
+const WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';
+export class DeviceIntegrityWeb extends WebPlugin {
+    async getCapabilities() {
+        return {
+            platform: 'web',
+            widevine: {
+                supported: false,
+                fingerprintAvailable: false,
+                securityLevelScanSupported: false,
+            },
+            appAttest: { supported: false },
+            deviceCheck: { supported: false },
+            playIntegrity: { supported: false },
+        };
+    }
+    async getWidevineFingerprint(_options) {
+        void _options;
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async prepareAttestation(_options) {
+        void _options;
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async createAttestation(_options) {
+        void _options;
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async createAssertion(_options) {
+        void _options;
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async getDeviceCheckToken() {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+}
+//# sourceMappingURL=web.js.map

package/dist/esm/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAe5C,MAAM,iBAAiB,GAAG,yFAAyF,CAAC;AAEpH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,KAAK,CAAC,eAAe;QACnB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK;gBAChB,oBAAoB,EAAE,KAAK;gBAC3B,0BAA0B,EAAE,KAAK;aAClC;YACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC/B,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YACjC,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,QAAqC;QAChE,KAAK,QAAQ,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAoC;QAC3D,KAAK,QAAQ,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAkC;QACxD,KAAK,QAAQ,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgC;QACpD,KAAK,QAAQ,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;CACF","sourcesContent":["import { WebPlugin } from '@capacitor/core';\n\nimport type {\n  AttestationTokenResult,\n  CreateAssertionOptions,\n  CreateAttestationOptions,\n  DeviceCheckTokenResult,\n  DeviceIntegrityCapabilities,\n  DeviceIntegrityPlugin,\n  PrepareAttestationOptions,\n  PrepareAttestationResult,\n  WidevineFingerprintOptions,\n  WidevineFingerprintResult,\n} from './definitions';\n\nconst WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';\n\nexport class DeviceIntegrityWeb extends WebPlugin implements DeviceIntegrityPlugin {\n  async getCapabilities(): Promise<DeviceIntegrityCapabilities> {\n    return {\n      platform: 'web',\n      widevine: {\n        supported: false,\n        fingerprintAvailable: false,\n        securityLevelScanSupported: false,\n      },\n      appAttest: { supported: false },\n      deviceCheck: { supported: false },\n      playIntegrity: { supported: false },\n    };\n  }\n\n  async getWidevineFingerprint(_options?: WidevineFingerprintOptions): Promise<WidevineFingerprintResult> {\n    void _options;\n    throw new Error(WEB_ERROR_MESSAGE);\n  }\n\n  async prepareAttestation(_options?: PrepareAttestationOptions): Promise<PrepareAttestationResult> {\n    void _options;\n    throw new Error(WEB_ERROR_MESSAGE);\n  }\n\n  async createAttestation(_options: CreateAttestationOptions): Promise<AttestationTokenResult> {\n    void _options;\n    throw new Error(WEB_ERROR_MESSAGE);\n  }\n\n  async createAssertion(_options: CreateAssertionOptions): Promise<AttestationTokenResult> {\n    void _options;\n    throw new Error(WEB_ERROR_MESSAGE);\n  }\n\n  async getDeviceCheckToken(): Promise<DeviceCheckTokenResult> {\n    throw new Error(WEB_ERROR_MESSAGE);\n  }\n}\n"]}

package/dist/plugin.cjs.js

@@ -0,0 +1,47 @@
+'use strict';
+
+var core = require('@capacitor/core');
+
+const DeviceIntegrity = core.registerPlugin('DeviceIntegrity', {
+    web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.DeviceIntegrityWeb()),
+});
+
+const WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';
+class DeviceIntegrityWeb extends core.WebPlugin {
+    async getCapabilities() {
+        return {
+            platform: 'web',
+            widevine: {
+                supported: false,
+                fingerprintAvailable: false,
+                securityLevelScanSupported: false,
+            },
+            appAttest: { supported: false },
+            deviceCheck: { supported: false },
+            playIntegrity: { supported: false },
+        };
+    }
+    async getWidevineFingerprint(_options) {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async prepareAttestation(_options) {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async createAttestation(_options) {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async createAssertion(_options) {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+    async getDeviceCheckToken() {
+        throw new Error(WEB_ERROR_MESSAGE);
+    }
+}
+
+var web = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    DeviceIntegrityWeb: DeviceIntegrityWeb
+});
+
+exports.DeviceIntegrity = DeviceIntegrity;
+//# sourceMappingURL=plugin.cjs.js.map

package/dist/plugin.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.cjs.js","sources":["esm/index.js","esm/web.js"],"sourcesContent":["import { registerPlugin } from '@capacitor/core';\nconst DeviceIntegrity = registerPlugin('DeviceIntegrity', {\n    web: () => import('./web').then((m) => new m.DeviceIntegrityWeb()),\n});\nexport * from './definitions';\nexport { DeviceIntegrity };\n//# sourceMappingURL=index.js.map","import { WebPlugin } from '@capacitor/core';\nconst WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';\nexport class DeviceIntegrityWeb extends WebPlugin {\n    async getCapabilities() {\n        return {\n            platform: 'web',\n            widevine: {\n                supported: false,\n                fingerprintAvailable: false,\n                securityLevelScanSupported: false,\n            },\n            appAttest: { supported: false },\n            deviceCheck: { supported: false },\n            playIntegrity: { supported: false },\n        };\n    }\n    async getWidevineFingerprint(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async prepareAttestation(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async createAttestation(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async createAssertion(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async getDeviceCheckToken() {\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n}\n//# sourceMappingURL=web.js.map"],"names":["registerPlugin","WebPlugin"],"mappings":";;;;AACK,MAAC,eAAe,GAAGA,mBAAc,CAAC,iBAAiB,EAAE;AAC1D,IAAI,GAAG,EAAE,MAAM,mDAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC;AACtE,CAAC;;ACFD,MAAM,iBAAiB,GAAG,yFAAyF;AAC5G,MAAM,kBAAkB,SAASC,cAAS,CAAC;AAClD,IAAI,MAAM,eAAe,GAAG;AAC5B,QAAQ,OAAO;AACf,YAAY,QAAQ,EAAE,KAAK;AAC3B,YAAY,QAAQ,EAAE;AACtB,gBAAgB,SAAS,EAAE,KAAK;AAChC,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,gBAAgB,0BAA0B,EAAE,KAAK;AACjD,aAAa;AACb,YAAY,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;AAC3C,YAAY,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;AAC7C,YAAY,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;AAC/C,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,QAAQ,EAAE;AAE3C,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,QAAQ,EAAE;AAEvC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,QAAQ,EAAE;AAEtC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,QAAQ,EAAE;AAEpC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,mBAAmB,GAAG;AAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;AAC1C,IAAI;AACJ;;;;;;;;;"}

package/dist/plugin.js

@@ -0,0 +1,50 @@
+var capacitorDeviceIntegrity = (function (exports, core) {
+    'use strict';
+
+    const DeviceIntegrity = core.registerPlugin('DeviceIntegrity', {
+        web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.DeviceIntegrityWeb()),
+    });
+
+    const WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';
+    class DeviceIntegrityWeb extends core.WebPlugin {
+        async getCapabilities() {
+            return {
+                platform: 'web',
+                widevine: {
+                    supported: false,
+                    fingerprintAvailable: false,
+                    securityLevelScanSupported: false,
+                },
+                appAttest: { supported: false },
+                deviceCheck: { supported: false },
+                playIntegrity: { supported: false },
+            };
+        }
+        async getWidevineFingerprint(_options) {
+            throw new Error(WEB_ERROR_MESSAGE);
+        }
+        async prepareAttestation(_options) {
+            throw new Error(WEB_ERROR_MESSAGE);
+        }
+        async createAttestation(_options) {
+            throw new Error(WEB_ERROR_MESSAGE);
+        }
+        async createAssertion(_options) {
+            throw new Error(WEB_ERROR_MESSAGE);
+        }
+        async getDeviceCheckToken() {
+            throw new Error(WEB_ERROR_MESSAGE);
+        }
+    }
+
+    var web = /*#__PURE__*/Object.freeze({
+        __proto__: null,
+        DeviceIntegrityWeb: DeviceIntegrityWeb
+    });
+
+    exports.DeviceIntegrity = DeviceIntegrity;
+
+    return exports;
+
+})({}, capacitorExports);
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sources":["esm/index.js","esm/web.js"],"sourcesContent":["import { registerPlugin } from '@capacitor/core';\nconst DeviceIntegrity = registerPlugin('DeviceIntegrity', {\n    web: () => import('./web').then((m) => new m.DeviceIntegrityWeb()),\n});\nexport * from './definitions';\nexport { DeviceIntegrity };\n//# sourceMappingURL=index.js.map","import { WebPlugin } from '@capacitor/core';\nconst WEB_ERROR_MESSAGE = 'Device integrity is not available on web. Use the native Android or iOS implementation.';\nexport class DeviceIntegrityWeb extends WebPlugin {\n    async getCapabilities() {\n        return {\n            platform: 'web',\n            widevine: {\n                supported: false,\n                fingerprintAvailable: false,\n                securityLevelScanSupported: false,\n            },\n            appAttest: { supported: false },\n            deviceCheck: { supported: false },\n            playIntegrity: { supported: false },\n        };\n    }\n    async getWidevineFingerprint(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async prepareAttestation(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async createAttestation(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async createAssertion(_options) {\n        void _options;\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n    async getDeviceCheckToken() {\n        throw new Error(WEB_ERROR_MESSAGE);\n    }\n}\n//# sourceMappingURL=web.js.map"],"names":["registerPlugin","WebPlugin"],"mappings":";;;AACK,UAAC,eAAe,GAAGA,mBAAc,CAAC,iBAAiB,EAAE;IAC1D,IAAI,GAAG,EAAE,MAAM,mDAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACtE,CAAC;;ICFD,MAAM,iBAAiB,GAAG,yFAAyF;IAC5G,MAAM,kBAAkB,SAASC,cAAS,CAAC;IAClD,IAAI,MAAM,eAAe,GAAG;IAC5B,QAAQ,OAAO;IACf,YAAY,QAAQ,EAAE,KAAK;IAC3B,YAAY,QAAQ,EAAE;IACtB,gBAAgB,SAAS,EAAE,KAAK;IAChC,gBAAgB,oBAAoB,EAAE,KAAK;IAC3C,gBAAgB,0BAA0B,EAAE,KAAK;IACjD,aAAa;IACb,YAAY,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC3C,YAAY,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC7C,YAAY,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC/C,SAAS;IACT,IAAI;IACJ,IAAI,MAAM,sBAAsB,CAAC,QAAQ,EAAE;IAE3C,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI;IACJ,IAAI,MAAM,kBAAkB,CAAC,QAAQ,EAAE;IAEvC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI;IACJ,IAAI,MAAM,iBAAiB,CAAC,QAAQ,EAAE;IAEtC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI;IACJ,IAAI,MAAM,eAAe,CAAC,QAAQ,EAAE;IAEpC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI;IACJ,IAAI,MAAM,mBAAmB,GAAG;IAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI;IACJ;;;;;;;;;;;;;;;"}

package/ios/Sources/DeviceIntegrityPlugin/DeviceIntegrity.swift

@@ -0,0 +1,49 @@
+import CryptoKit
+import DeviceCheck
+import Foundation
+
+@objc public class DeviceIntegrity: NSObject {
+    @objc public func isAppAttestSupported() -> Bool {
+        return DCAppAttestService.shared.isSupported
+    }
+
+    @objc public func isDeviceCheckSupported() -> Bool {
+        return DCDevice.current.isSupported
+    }
+
+    public func createClientDataHash(from input: String) throws -> Data {
+        guard let payloadData = input.data(using: .utf8) else {
+            throw DeviceIntegrityError.invalidInput
+        }
+        return Data(SHA256.hash(data: payloadData))
+    }
+}
+
+public enum DeviceIntegrityError: LocalizedError {
+    case appAttestNotSupported
+    case deviceCheckNotSupported
+    case missingKeyId
+    case missingChallenge
+    case missingPayload
+    case missingGeneratedValue
+    case invalidInput
+
+    public var errorDescription: String? {
+        switch self {
+        case .appAttestNotSupported:
+            return "App Attest is not supported on this device"
+        case .deviceCheckNotSupported:
+            return "DeviceCheck is not supported on this device"
+        case .missingKeyId:
+            return "keyId is required"
+        case .missingChallenge:
+            return "challenge is required"
+        case .missingPayload:
+            return "payload is required"
+        case .missingGeneratedValue:
+            return "Native API returned no value"
+        case .invalidInput:
+            return "Invalid input format"
+        }
+    }
+}

package/ios/Sources/DeviceIntegrityPlugin/DeviceIntegrityPlugin.swift

@@ -0,0 +1,208 @@
+import Capacitor
+import DeviceCheck
+import Foundation
+
+@objc(DeviceIntegrityPlugin)
+public class DeviceIntegrityPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "DeviceIntegrityPlugin"
+    public let jsName = "DeviceIntegrity"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "getCapabilities", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "getWidevineFingerprint", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "prepareAttestation", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "createAttestation", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "createAssertion", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "getDeviceCheckToken", returnType: CAPPluginReturnPromise)
+    ]
+
+    private let implementation = DeviceIntegrity()
+    private let appAttestFormat = "apple-app-attest"
+
+    @objc func getCapabilities(_ call: CAPPluginCall) {
+        call.resolve([
+            "platform": "ios",
+            "widevine": [
+                "supported": false,
+                "fingerprintAvailable": false,
+                "securityLevelScanSupported": false
+            ],
+            "appAttest": [
+                "supported": implementation.isAppAttestSupported()
+            ],
+            "deviceCheck": [
+                "supported": implementation.isDeviceCheckSupported()
+            ],
+            "playIntegrity": [
+                "supported": false
+            ]
+        ])
+    }
+
+    @objc func getWidevineFingerprint(_ call: CAPPluginCall) {
+        call.reject("Widevine fingerprinting is only available on Android")
+    }
+
+    @objc func prepareAttestation(_ call: CAPPluginCall) {
+        do {
+            try validateAppAttestSupport()
+
+            DCAppAttestService.shared.generateKey { [weak self] keyId, error in
+                guard let self else {
+                    return
+                }
+
+                if let error {
+                    self.reject(call, message: "Error generating App Attest key: \(error.localizedDescription)", error: error)
+                    return
+                }
+
+                guard let keyId else {
+                    self.reject(call, message: DeviceIntegrityError.missingGeneratedValue.localizedDescription)
+                    return
+                }
+
+                self.resolve(call, payload: [
+                    "keyId": keyId,
+                    "format": self.appAttestFormat
+                ])
+            }
+        } catch {
+            reject(call, message: error.localizedDescription, error: error)
+        }
+    }
+
+    @objc func createAttestation(_ call: CAPPluginCall) {
+        do {
+            try validateAppAttestSupport()
+            let keyId = try keyId(from: call)
+            let challenge = try challenge(from: call)
+            let clientDataHash = try implementation.createClientDataHash(from: challenge)
+
+            DCAppAttestService.shared.attestKey(keyId, clientDataHash: clientDataHash) { [weak self] attestation, error in
+                guard let self else {
+                    return
+                }
+
+                if let error {
+                    self.reject(call, message: "Error creating App Attest token: \(error.localizedDescription)", error: error)
+                    return
+                }
+
+                guard let attestation else {
+                    self.reject(call, message: DeviceIntegrityError.missingGeneratedValue.localizedDescription)
+                    return
+                }
+
+                self.resolve(call, payload: [
+                    "token": attestation.base64EncodedString(),
+                    "keyId": keyId,
+                    "format": self.appAttestFormat
+                ])
+            }
+        } catch {
+            reject(call, message: error.localizedDescription, error: error)
+        }
+    }
+
+    @objc func createAssertion(_ call: CAPPluginCall) {
+        do {
+            try validateAppAttestSupport()
+            let keyId = try keyId(from: call)
+            let payload = try payload(from: call)
+            let clientDataHash = try implementation.createClientDataHash(from: payload)
+
+            DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: clientDataHash) { [weak self] assertion, error in
+                guard let self else {
+                    return
+                }
+
+                if let error {
+                    self.reject(call, message: "Error creating App Attest assertion: \(error.localizedDescription)", error: error)
+                    return
+                }
+
+                guard let assertion else {
+                    self.reject(call, message: DeviceIntegrityError.missingGeneratedValue.localizedDescription)
+                    return
+                }
+
+                self.resolve(call, payload: [
+                    "token": assertion.base64EncodedString(),
+                    "keyId": keyId,
+                    "format": self.appAttestFormat
+                ])
+            }
+        } catch {
+            reject(call, message: error.localizedDescription, error: error)
+        }
+    }
+
+    @objc func getDeviceCheckToken(_ call: CAPPluginCall) {
+        do {
+            guard implementation.isDeviceCheckSupported() else {
+                throw DeviceIntegrityError.deviceCheckNotSupported
+            }
+
+            DCDevice.current.generateToken { [weak self] token, error in
+                guard let self else {
+                    return
+                }
+
+                if let error {
+                    self.reject(call, message: "Error generating DeviceCheck token: \(error.localizedDescription)", error: error)
+                    return
+                }
+
+                guard let token else {
+                    self.reject(call, message: DeviceIntegrityError.missingGeneratedValue.localizedDescription)
+                    return
+                }
+
+                self.resolve(call, payload: [
+                    "token": token.base64EncodedString()
+                ])
+            }
+        } catch {
+            reject(call, message: error.localizedDescription, error: error)
+        }
+    }
+
+    private func validateAppAttestSupport() throws {
+        guard implementation.isAppAttestSupported() else {
+            throw DeviceIntegrityError.appAttestNotSupported
+        }
+    }
+
+    private func keyId(from call: CAPPluginCall) throws -> String {
+        guard let keyId = call.getString("keyId"), !keyId.isEmpty else {
+            throw DeviceIntegrityError.missingKeyId
+        }
+        return keyId
+    }
+
+    private func challenge(from call: CAPPluginCall) throws -> String {
+        guard let challenge = call.getString("challenge"), !challenge.isEmpty else {
+            throw DeviceIntegrityError.missingChallenge
+        }
+        return challenge
+    }
+
+    private func payload(from call: CAPPluginCall) throws -> String {
+        guard let payload = call.getString("payload"), !payload.isEmpty else {
+            throw DeviceIntegrityError.missingPayload
+        }
+        return payload
+    }
+
+    private func resolve(_ call: CAPPluginCall, payload: [String: Any]) {
+        DispatchQueue.main.async {
+            call.resolve(payload)
+        }
+    }
+
+    private func reject(_ call: CAPPluginCall, message: String, error: Error? = nil) {
+        DispatchQueue.main.async {
+            call.reject(message, nil, error)
+        }
+    }
+}

package/ios/Tests/DeviceIntegrityPluginTests/DeviceIntegrityTests.swift

@@ -0,0 +1,24 @@
+import CryptoKit
+import XCTest
+@testable import DeviceIntegrityPlugin
+
+final class DeviceIntegrityTests: XCTestCase {
+    func testCreateClientDataHashUsesSha256() throws {
+        let implementation = DeviceIntegrity()
+        let payload = "server-issued-challenge"
+
+        let result = try implementation.createClientDataHash(from: payload)
+        let expected = Data(SHA256.hash(data: Data(payload.utf8)))
+
+        XCTAssertEqual(result, expected)
+    }
+
+    func testSupportChecksReturnBooleanValues() {
+        let implementation = DeviceIntegrity()
+        let appAttestSupported = implementation.isAppAttestSupported()
+        let deviceCheckSupported = implementation.isDeviceCheckSupported()
+
+        XCTAssertTrue(appAttestSupported || !appAttestSupported)
+        XCTAssertTrue(deviceCheckSupported || !deviceCheckSupported)
+    }
+}

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@capgo/capacitor-device-integrity",
+  "version": "8.0.2",
+  "description": "Device integrity and fraud signals for Capacitor using Android Widevine, Play Integrity, iOS App Attest, and DeviceCheck.",
+  "main": "dist/plugin.cjs.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "unpkg": "dist/plugin.js",
+  "files": [
+    "android/src/main/",
+    "android/build.gradle",
+    "dist/",
+    "ios/Sources",
+    "ios/Tests",
+    "Package.swift",
+    "CapgoCapacitorDeviceIntegrity.podspec"
+  ],
+  "author": "Martin Donadieu <martin@capgo.app>",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cap-go/capacitor-device-integrity.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Cap-go/capacitor-device-integrity/issues"
+  },
+  "homepage": "https://capgo.app/docs/plugins/device-integrity/",
+  "keywords": [
+    "capacitor",
+    "device-integrity",
+    "fraud-detection",
+    "widevine",
+    "app-attest",
+    "devicecheck",
+    "play-integrity",
+    "capgo"
+  ],
+  "scripts": {
+    "verify": "bun run verify:ios && bun run verify:android && bun run verify:web",
+    "verify:ios": "xcodebuild -scheme CapgoCapacitorDeviceIntegrity -destination generic/platform=iOS",
+    "verify:android": "cd android && ./gradlew clean build test && cd ..",
+    "verify:web": "bun run build",
+    "lint": "bun run eslint && bun run prettier -- --check && bun run swiftlint -- lint",
+    "fmt": "bun run eslint -- --fix && bun run prettier -- --write && bun run swiftlint -- --fix --format",
+    "eslint": "eslint . --ext .ts",
+    "prettier": "prettier-pretty-check \"**/*.{css,html,ts,js,java}\" --plugin=prettier-plugin-java",
+    "swiftlint": "node-swiftlint",
+    "docgen": "docgen --api DeviceIntegrityPlugin --output-readme README.md --output-json dist/docs.json",
+    "build": "bun run clean && bun run docgen && tsc && rollup -c rollup.config.mjs",
+    "clean": "rimraf ./dist",
+    "watch": "tsc --watch",
+    "prepublishOnly": "bun run build",
+    "check:wiring": "node scripts/check-capacitor-plugin-wiring.mjs"
+  },
+  "devDependencies": {
+    "@capacitor/android": "^8.0.0",
+    "@capacitor/cli": "^8.0.0",
+    "@capacitor/core": "^8.0.0",
+    "@capacitor/docgen": "^0.3.1",
+    "@capacitor/ios": "^8.0.0",
+    "@ionic/eslint-config": "^0.4.0",
+    "@ionic/prettier-config": "^4.0.0",
+    "@ionic/swiftlint-config": "^2.0.0",
+    "@types/node": "^24.10.1",
+    "eslint": "^8.57.1",
+    "eslint-plugin-import": "^2.31.0",
+    "husky": "^9.1.7",
+    "prettier": "^3.6.2",
+    "prettier-pretty-check": "^0.2.0",
+    "prettier-plugin-java": "^2.7.7",
+    "rimraf": "^6.1.0",
+    "rollup": "^4.53.2",
+    "swiftlint": "^2.0.0",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@capacitor/core": ">=8.0.0"
+  },
+  "prettier": "@ionic/prettier-config",
+  "swiftlint": "@ionic/swiftlint-config",
+  "eslintConfig": {
+    "extends": "@ionic/eslint-config/recommended"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  }
+}