react-native-dev-guard 1.0.0 → 1.0.1

package/lib/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.useDevGuard = exports.DevGuardProvider = void 0;
+exports.resolveBrandingFooter = exports.useDevGuard = exports.DevGuardProvider = void 0;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const react_native_1 = require("react-native");
@@ -21,10 +21,10 @@ const DiagnosticOverlay_1 = require("./components/DiagnosticOverlay");
 const DevGuardLogger_1 = require("./services/DevGuardLogger");
 const GuardEnforcement_1 = require("./services/GuardEnforcement");
 const RemoteWipeService_1 = require("./services/RemoteWipeService");
+const obf_1 = require("./internal/obf");
 const react_native_2 = require("react-native");
 const react_native_safe_area_context_1 = require("react-native-safe-area-context");
 const { DevGuard: DevGuardNative } = react_native_1.NativeModules;
-const API_URL = 'https://api.devguard.uk/devguard';
 const DevGuardContext = (0, react_1.createContext)(undefined);
 const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = true, failSafe = 'open' }) => {
     const authSecret = secret ?? apiKey;
@@ -35,6 +35,7 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
     const heartbeatTimer = (0, react_1.useRef)(null);
     const lastSyncTime = (0, react_1.useRef)(0);
     const [showDiagnostics, setShowDiagnostics] = (0, react_1.useState)(false);
+    const isCompromisedRef = (0, react_1.useRef)(false);
     const lastLifecycleSyncTime = (0, react_1.useRef)(0);
     // Mirror of `response` for use inside long-lived closures (AppState listener,
     // heartbeat). Those callbacks are registered once, so reading the `response`
@@ -42,6 +43,7 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
     // telemetry consent and lifecycle gating. The ref always holds the latest.
     // (Parity with Flutter, where these reads hit the `_cachedResponse` field.)
     const responseRef = (0, react_1.useRef)(null);
+    const verifyChainRef = (0, react_1.useRef)(Promise.resolve());
     (0, react_1.useEffect)(() => {
         responseRef.current = response;
     }, [response]);
@@ -94,144 +96,154 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
         return true;
     };
     const verify = async (force = false, trigger) => {
-        if (!shouldSync(force, trigger)) {
-            console.log('DevGuard: Sync skipped due to policy.');
-            return;
-        }
-        try {
-            const hardware = HardwareService_1.HardwareService.getInstance();
-            const deviceId = await hardware.getDeviceId();
-            // Use the ref (not the possibly-stale closed-over `response`) so advanced
-            // telemetry consent is honored on heartbeat/lifecycle-triggered syncs.
-            const metadata = await hardware.getMetadata(responseRef.current?.betaFeatures);
-            const timestamp = Date.now().toString();
-            // Align payload with Flutter: Metadata map is the core payload 'p'
-            const payload = JSON.stringify({
-                ...metadata,
-                projectId,
-                timestamp: parseInt(timestamp, 10)
-            });
-            // GZip + Base64 Tunneling (v1-gzip)
-            const compressed = pako_1.default.gzip(payload);
-            const uint8ToBase64 = (data) => {
-                const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-                let result = '';
-                let i;
-                const l = data.length;
-                for (i = 2; i < l; i += 3) {
-                    result += chars[data[i - 2] >> 2];
-                    result += chars[((data[i - 2] & 0x03) << 4) | (data[i - 1] >> 4)];
-                    result += chars[((data[i - 1] & 0x0f) << 2) | (data[i] >> 6)];
-                    result += chars[data[i] & 0x3f];
-                }
-                if (i === l + 1) {
-                    result += chars[data[i - 2] >> 2];
-                    result += chars[(data[i - 2] & 0x03) << 4];
-                    result += '==';
-                }
-                else if (i === l) {
-                    result += chars[data[i - 2] >> 2];
-                    result += chars[((data[i - 2] & 0x03) << 4) | (data[i - 1] >> 4)];
-                    result += chars[(data[i - 1] & 0x0f) << 2];
-                    result += '=';
-                }
-                return result;
-            };
-            const base64Payload = uint8ToBase64(compressed);
-            const signature = await DevGuardNative.generateSignature(projectId, parseInt(timestamp, 10));
-            const fetchUrl = API_URL;
-            const fetchOptions = {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'X-DevGuard-Signature': signature,
-                    'X-DevGuard-Timestamp': timestamp,
-                    'X-DevGuard-Tunnel': 'v1-gzip',
-                    ...(authSecret ? { 'X-DevGuard-API-Key': authSecret } : {})
-                },
-                body: JSON.stringify({
-                    projectId,
-                    deviceId: metadata.deviceId,
-                    deviceName: metadata.deviceName,
-                    model: metadata.model,
-                    os: metadata.os,
-                    version: metadata.version,
-                    isPhysicalDevice: metadata.isPhysicalDevice,
-                    username: metadata.username,
-                    email: metadata.email,
-                    phone: metadata.phone,
-                    customData: metadata.customData,
-                    fingerprint: metadata.fingerprint,
-                    deviceToken: metadata.deviceToken,
-                    location: metadata.location,
-                    p: base64Payload
-                })
-            };
-            const fetchResponse = await fetch(fetchUrl, fetchOptions);
-            if (!fetchResponse.ok) {
-                throw new Error('API_UNREACHABLE');
+        const run = async () => {
+            if (!shouldSync(force, trigger)) {
+                console.log(obf_1.Obf.syncSkipped);
+                return;
             }
-            const responseText = await fetchResponse.text();
-            const result = JSON.parse(responseText);
-            // Verify Response Signature
-            const responseSig = fetchResponse.headers.get('X-DevGuard-Response-Signature');
-            if (responseSig) {
-                const isValid = await DevGuardNative.verifyResponse(responseText, responseSig);
-                if (!isValid) {
-                    if (result.betaFeatures?.bypassSignature === true) {
-                        console.warn('DevGuard: Response signature mismatch, but bypassSignature is ACTIVE.');
+            try {
+                const hardware = HardwareService_1.HardwareService.getInstance();
+                const deviceId = await hardware.getDeviceId();
+                // Use the ref (not the possibly-stale closed-over `response`) so advanced
+                // telemetry consent is honored on heartbeat/lifecycle-triggered syncs.
+                const metadata = await hardware.getMetadata(responseRef.current?.betaFeatures);
+                const timestamp = Date.now().toString();
+                // Align payload with Flutter: Metadata map is the core payload 'p'
+                const payload = JSON.stringify({
+                    ...metadata,
+                    [obf_1.Obf.projectId]: projectId,
+                    timestamp: parseInt(timestamp, 10)
+                });
+                // GZip + Base64 Tunneling (v1-gzip)
+                const compressed = pako_1.default.gzip(payload);
+                const uint8ToBase64 = (data) => {
+                    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+                    let result = '';
+                    let i;
+                    const l = data.length;
+                    for (i = 2; i < l; i += 3) {
+                        result += chars[data[i - 2] >> 2];
+                        result += chars[((data[i - 2] & 0x03) << 4) | (data[i - 1] >> 4)];
+                        result += chars[((data[i - 1] & 0x0f) << 2) | (data[i] >> 6)];
+                        result += chars[data[i] & 0x3f];
+                    }
+                    if (i === l + 1) {
+                        result += chars[data[i - 2] >> 2];
+                        result += chars[(data[i - 2] & 0x03) << 4];
+                        result += '==';
                     }
-                    else {
-                        console.error('DevGuard: Response signature mismatch! Possible tampering detected.');
-                        setStatus('LOCKED');
-                        return;
+                    else if (i === l) {
+                        result += chars[data[i - 2] >> 2];
+                        result += chars[((data[i - 2] & 0x03) << 4) | (data[i - 1] >> 4)];
+                        result += chars[(data[i - 1] & 0x0f) << 2];
+                        result += '=';
                     }
+                    return result;
+                };
+                const base64Payload = uint8ToBase64(compressed);
+                const signature = await DevGuardNative.generateSignature(projectId, parseInt(timestamp, 10));
+                const fetchUrl = obf_1.Obf.defaultApiUrl;
+                const fetchOptions = {
+                    method: 'POST',
+                    headers: {
+                        [obf_1.Obf.contentType]: obf_1.Obf.appJson,
+                        [obf_1.Obf.hdrSig]: signature,
+                        [obf_1.Obf.hdrTs]: timestamp,
+                        [obf_1.Obf.hdrTunnel]: obf_1.Obf.tunnelV1,
+                        ...(authSecret ? { [obf_1.Obf.hdrApiKey]: authSecret } : {})
+                    },
+                    body: JSON.stringify({
+                        [obf_1.Obf.projectId]: projectId,
+                        [obf_1.Obf.deviceId]: metadata.deviceId,
+                        [obf_1.Obf.deviceName]: metadata.deviceName,
+                        [obf_1.Obf.model]: metadata.model,
+                        [obf_1.Obf.os]: metadata.os,
+                        [obf_1.Obf.version]: metadata.version,
+                        [obf_1.Obf.isPhysicalDevice]: metadata.isPhysicalDevice,
+                        [obf_1.Obf.username]: metadata.username,
+                        [obf_1.Obf.email]: metadata.email,
+                        [obf_1.Obf.phone]: metadata.phone,
+                        [obf_1.Obf.customData]: metadata.customData,
+                        [obf_1.Obf.fingerprint]: metadata.fingerprint,
+                        [obf_1.Obf.deviceToken]: metadata.deviceToken,
+                        [obf_1.Obf.location]: metadata.location,
+                        [obf_1.Obf.payloadField]: base64Payload
+                    })
+                };
+                const fetchResponse = await fetch(fetchUrl, fetchOptions);
+                if (!fetchResponse.ok) {
+                    throw new Error(obf_1.Obf.apiUnreachable);
+                }
+                const responseText = await fetchResponse.text();
+                const result = JSON.parse(responseText);
+                // Verify Response Signature
+                const responseSig = fetchResponse.headers.get(obf_1.Obf.respSig);
+                if (responseSig) {
+                    const isValid = await DevGuardNative.verifyResponse(responseText, responseSig);
+                    if (!isValid) {
+                        if (result[obf_1.Obf.betaFeatures]?.[obf_1.Obf.bypassSignature] === true) {
+                            console.warn(obf_1.Obf.invalidSigBypassLog);
+                        }
+                        else {
+                            console.error(obf_1.Obf.invalidSigLog);
+                            const enforced = await GuardEnforcement_1.GuardEnforcement.apply({ ...result, status: 'LOCKED' }, metadata, isCompromisedRef.current);
+                            responseRef.current = enforced;
+                            setResponse(enforced);
+                            setStatus('LOCKED');
+                            return;
+                        }
+                    }
+                }
+                else {
+                    console.warn(obf_1.Obf.missingSigLog);
+                }
+                // Client-side enforcement (emulator / compromised) — parity with Flutter.
+                const enforced = await GuardEnforcement_1.GuardEnforcement.apply(result, metadata, isCompromisedRef.current);
+                const finalStatus = String(enforced[obf_1.Obf.statusField] || 'ERROR').toUpperCase();
+                responseRef.current = enforced; // keep ref fresh for chained/triggered syncs
+                setResponse(enforced);
+                setStatus(finalStatus);
+                setShowWarning(finalStatus === 'WARNING');
+                lastSyncTime.current = Date.now();
+                CacheService_1.CacheService.saveResponse(projectId, enforced);
+                // Handle Beta Features (Parity with Flutter)
+                if (finalStatus === 'WARNING' && result.betaFeatures?.vibrateOnWarning === true) {
+                    react_native_1.Vibration.vibrate();
+                }
+                const wipeNonce = result.betaFeatures?.wipeNonce;
+                if (typeof wipeNonce === 'number' && wipeNonce > 0) {
+                    await executeRemoteWipe(wipeNonce);
+                }
+                // Heartbeat management
+                startHeartbeat(result);
+                // Handle Device Token (Parity with Flutter)
+                if (result.deviceToken) {
+                    await DeviceTokenService_1.DeviceTokenService.getInstance().saveToken(result.deviceToken, result.betaFeatures?.secureEnclave === true);
+                }
+                // Handle Remote Commands (Parity with Flutter)
+                if (result.remoteCommand && result.remoteCommand !== 'none') {
+                    await handleRemoteCommand(result.remoteCommand);
+                }
+                // Clear logs after successful sync
+                if (metadata.usageLogs && metadata.usageLogs.length > 0) {
+                    await UsageLogger_1.UsageLogger.getInstance().clearLogs();
                 }
             }
-            else {
-                console.warn('DevGuard: Missing server response signature.');
-            }
-            // Client-side enforcement (e.g. blockEmulators) — parity with Flutter.
-            const enforced = GuardEnforcement_1.GuardEnforcement.apply(result, metadata);
-            const finalStatus = String(enforced.status || 'ERROR').toUpperCase();
-            responseRef.current = enforced; // keep ref fresh for chained/triggered syncs
-            setResponse(enforced);
-            setStatus(finalStatus);
-            setShowWarning(finalStatus === 'WARNING');
-            lastSyncTime.current = Date.now();
-            CacheService_1.CacheService.saveResponse(projectId, enforced);
-            // Handle Beta Features (Parity with Flutter)
-            if (finalStatus === 'WARNING' && result.betaFeatures?.vibrateOnWarning === true) {
-                react_native_1.Vibration.vibrate();
-            }
-            const wipeNonce = result.betaFeatures?.wipeNonce;
-            if (typeof wipeNonce === 'number' && wipeNonce > 0) {
-                await executeRemoteWipe(wipeNonce);
-            }
-            // Heartbeat management
-            startHeartbeat(result);
-            // Handle Device Token (Parity with Flutter)
-            if (result.deviceToken) {
-                await DeviceTokenService_1.DeviceTokenService.getInstance().saveToken(result.deviceToken, result.betaFeatures?.secureEnclave === true);
-            }
-            // Handle Remote Commands (Parity with Flutter)
-            if (result.remoteCommand && result.remoteCommand !== 'none') {
-                await handleRemoteCommand(result.remoteCommand);
-            }
-            // Clear logs after successful sync
-            if (metadata.usageLogs && metadata.usageLogs.length > 0) {
-                await UsageLogger_1.UsageLogger.getInstance().clearLogs();
-            }
-        }
-        catch (e) {
-            console.error('DevGuard Verification Failed:', e);
-            if (failSafe === 'open' && status === 'PENDING') {
-                setStatus('ACTIVE');
-            }
-            else if (failSafe === 'closed') {
-                setStatus('LOCKED');
+            catch (e) {
+                console.error('DevGuard Verification Failed:', e);
+                if (failSafe === 'open' && status === 'PENDING') {
+                    setStatus('ACTIVE');
+                }
+                else if (failSafe === 'closed') {
+                    setStatus('LOCKED');
+                }
             }
-        }
+        };
+        // Always serialize verify runs — never reset the chain on force, or parallel
+        // fetches race and a stale WARNING response can overwrite LOCKED (physical E2E).
+        const chained = verifyChainRef.current.then(() => run()).catch(() => { });
+        verifyChainRef.current = chained;
+        return chained;
     };
     const startHeartbeat = (res) => {
         if (heartbeatTimer.current)
@@ -287,20 +299,20 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
             const hashedKey = crypto_js_1.default.SHA256(key).toString();
             const timestamp = Date.now().toString();
             const signature = await DevGuardNative.generateSignature(projectId, parseInt(timestamp, 10));
-            const payload = JSON.stringify({ projectId, providedKey: hashedKey });
-            const fetchResponse = await fetch(`${API_URL}/unlock`, {
+            const payload = JSON.stringify({ [obf_1.Obf.projectId]: projectId, [obf_1.Obf.providedKey]: hashedKey });
+            const fetchResponse = await fetch(`${obf_1.Obf.defaultApiUrl}${obf_1.Obf.unlockPath}`, {
                 method: 'POST',
                 headers: {
-                    'Content-Type': 'application/json',
-                    'X-DevGuard-Signature': signature,
-                    'X-DevGuard-Timestamp': timestamp,
-                    ...(authSecret ? { 'X-DevGuard-API-Key': authSecret } : {})
+                    [obf_1.Obf.contentType]: obf_1.Obf.appJson,
+                    [obf_1.Obf.hdrSig]: signature,
+                    [obf_1.Obf.hdrTs]: timestamp,
+                    ...(authSecret ? { [obf_1.Obf.hdrApiKey]: authSecret } : {})
                 },
                 body: payload
             });
             if (fetchResponse.ok) {
                 const text = await fetchResponse.text();
-                if (text === 'Unlocked') {
+                if (text === obf_1.Obf.unlocked) {
                     await verify();
                     return true;
                 }
@@ -332,13 +344,10 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
                 const deviceId = await HardwareService_1.HardwareService.getInstance().getDeviceId();
                 await DevGuardLogger_1.DevGuardLogger.init(deviceId);
                 const isJailbroken = await react_native_jailbreak_1.default.check();
+                isCompromisedRef.current = isJailbroken;
                 if (isJailbroken) {
-                    console.warn('DevGuard Security Alert: Compromised device detected.');
-                    setResponse({
-                        status: 'LOCKED',
-                        title: 'Security Alert',
-                        message: 'This application cannot run on jailbroken or rooted devices for security reasons.',
-                    });
+                    const locked = await GuardEnforcement_1.GuardEnforcement.apply({ status: 'ACTIVE' }, { isPhysicalDevice: true }, true);
+                    setResponse(locked);
                     setStatus('LOCKED');
                     return;
                 }
@@ -384,7 +393,7 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
     }, []);
     const isLocked = status === 'LOCKED' || status === 'EXPIRED';
     const showBugIcon = response?.betaFeatures?.showDiagnosticLogs === true;
-    return ((0, jsx_runtime_1.jsxs)(DevGuardContext.Provider, { value: { status, verify, unlock, setDeviceUser, isLocked, response }, children: [showWarning && status === 'WARNING' && ((0, jsx_runtime_1.jsx)(SecurityToast_1.SecurityToast, { title: response?.title || 'Security Warning', message: response?.message })), autoProtect && isLocked ? ((0, jsx_runtime_1.jsx)(LockScreen_1.LockScreen, { status: status, title: response?.title, message: response?.message, contactEmail: response?.contactEmail, contactPhone: response?.contactPhone, contactWhatsapp: response?.contactWhatsapp, allowUnlock: response?.allowUnlock, onUnlock: unlock })) : ((0, jsx_runtime_1.jsxs)(react_native_2.View, { style: { flex: 1 }, children: [children, showBugIcon && ((0, jsx_runtime_1.jsx)(react_native_safe_area_context_1.SafeAreaInsetsContext.Consumer, { children: (insets) => {
+    return ((0, jsx_runtime_1.jsxs)(DevGuardContext.Provider, { value: { status, verify, unlock, setDeviceUser, isLocked, response }, children: [showWarning && status === 'WARNING' && ((0, jsx_runtime_1.jsx)(SecurityToast_1.SecurityToast, { title: response?.title || 'Security Warning', message: response?.message })), autoProtect && isLocked ? ((0, jsx_runtime_1.jsxs)(react_native_2.View, { style: { flex: 1 }, children: [(0, jsx_runtime_1.jsx)(LockScreen_1.LockScreen, { status: status, title: response?.title, message: response?.message, contactEmail: response?.contactEmail, contactPhone: response?.contactPhone, contactWhatsapp: response?.contactWhatsapp, allowUnlock: response?.allowUnlock === true, branding: response?.branding, onUnlock: unlock }), (0, jsx_runtime_1.jsx)(react_native_2.View, { style: styles.hiddenWhileLocked, pointerEvents: "none", children: children })] })) : ((0, jsx_runtime_1.jsxs)(react_native_2.View, { style: { flex: 1 }, children: [children, showBugIcon && ((0, jsx_runtime_1.jsx)(react_native_safe_area_context_1.SafeAreaInsetsContext.Consumer, { children: (insets) => {
                             const safeInsets = insets || { top: 0, bottom: 0, right: 0, left: 0 };
                             return ((0, jsx_runtime_1.jsx)(react_native_2.TouchableOpacity, { style: [
                                     styles.bugIcon,
@@ -394,6 +403,13 @@ const DevGuardProvider = ({ children, projectId, secret, apiKey, autoProtect = t
 };
 exports.DevGuardProvider = DevGuardProvider;
 const styles = react_native_2.StyleSheet.create({
+    hiddenWhileLocked: {
+        position: 'absolute',
+        width: 1,
+        height: 1,
+        opacity: 0,
+        overflow: 'hidden',
+    },
     bugIcon: {
         position: 'absolute',
         right: 20,
@@ -417,3 +433,5 @@ const useDevGuard = () => {
     return context;
 };
 exports.useDevGuard = useDevGuard;
+var branding_1 = require("./types/branding");
+Object.defineProperty(exports, "resolveBrandingFooter", { enumerable: true, get: function () { return branding_1.resolveBrandingFooter; } });

package/lib/internal/obf.d.ts

@@ -0,0 +1,72 @@
+/** Auto-generated by tool/genObf.js — do not edit by hand. */
+export declare const Obf: {
+    readonly symX9: string;
+    readonly symV2: string;
+    readonly symS3: string;
+    readonly symG4: string;
+    readonly symH5: string;
+    readonly symX6: string;
+    readonly symD7: string;
+    readonly symR8: string;
+    readonly symE1: string;
+    readonly contentType: string;
+    readonly appJson: string;
+    readonly hdrSig: string;
+    readonly hdrTs: string;
+    readonly hdrTunnel: string;
+    readonly hdrApiKey: string;
+    readonly respSig: string;
+    readonly tunnelV1: string;
+    readonly projectId: string;
+    readonly deviceId: string;
+    readonly deviceName: string;
+    readonly model: string;
+    readonly os: string;
+    readonly version: string;
+    readonly isPhysicalDevice: string;
+    readonly username: string;
+    readonly email: string;
+    readonly phone: string;
+    readonly customData: string;
+    readonly fingerprint: string;
+    readonly deviceToken: string;
+    readonly location: string;
+    readonly payloadField: string;
+    readonly unlockPath: string;
+    readonly providedKey: string;
+    readonly unlocked: string;
+    readonly defaultApiUrl: string;
+    readonly betaFeatures: string;
+    readonly bypassSignature: string;
+    readonly statusField: string;
+    readonly emulatorTitle: string;
+    readonly emulatorMessage: string;
+    readonly securityTitle: string;
+    readonly compromisedMessage: string;
+    readonly compromisedLog: string;
+    readonly missingSigLog: string;
+    readonly invalidSigBypassLog: string;
+    readonly invalidSigLog: string;
+    readonly invalidUnlockKey: string;
+    readonly enterUnlockKey: string;
+    readonly licenseKeyHint: string;
+    readonly cancelLabel: string;
+    readonly unlockLabel: string;
+    readonly whatsappSupport: string;
+    readonly emailSupport: string;
+    readonly callSupport: string;
+    readonly defaultLockMessage: string;
+    readonly contactOpenError: string;
+    readonly poweredBy: string;
+    readonly securedBy: string;
+    readonly brandDefault: string;
+    readonly brandWebsite: string;
+    readonly apiUnreachable: string;
+    readonly syncSkipped: string;
+};
+/** Native policy gate result codes (dg_e1). */
+export declare const PolicyLock: {
+    readonly allow: 0;
+    readonly emulator: 1;
+    readonly compromised: 2;
+};

package/lib/internal/obf.js

@@ -0,0 +1,100 @@
+"use strict";
+/** Auto-generated by tool/genObf.js — do not edit by hand. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyLock = exports.Obf = void 0;
+const MASK = [0xF1, 0x3A, 0xC7, 0x82, 0x5E, 0xD9, 0x44, 0xAB];
+function _d(encoded) {
+    const bytes = Uint8Array.from(encoded.map((b, i) => b ^ MASK[i % MASK.length]));
+    let out = '';
+    let i = 0;
+    while (i < bytes.length) {
+        const c = bytes[i++];
+        if (c < 0x80)
+            out += String.fromCharCode(c);
+        else if (c < 0xe0)
+            out += String.fromCharCode(((c & 0x1f) << 6) | (bytes[i++] & 0x3f));
+        else if (c < 0xf0) {
+            out += String.fromCharCode(((c & 0x0f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f));
+        }
+        else {
+            const code = ((c & 0x07) << 18) |
+                ((bytes[i++] & 0x3f) << 12) |
+                ((bytes[i++] & 0x3f) << 6) |
+                (bytes[i++] & 0x3f);
+            const offset = code - 0x10000;
+            out += String.fromCharCode(0xd800 + (offset >> 10), 0xdc00 + (offset & 0x3ff));
+        }
+    }
+    return out;
+}
+exports.Obf = {
+    get symX9() { return _d([149, 93, 152, 250, 103]); },
+    get symV2() { return _d([149, 93, 152, 244, 108]); },
+    get symS3() { return _d([149, 93, 152, 241, 109]); },
+    get symG4() { return _d([149, 93, 152, 229, 106]); },
+    get symH5() { return _d([149, 93, 152, 234, 107]); },
+    get symX6() { return _d([149, 93, 152, 250, 104]); },
+    get symD7() { return _d([149, 93, 152, 230, 105]); },
+    get symR8() { return _d([149, 93, 152, 240, 102]); },
+    get symE1() { return _d([149, 93, 152, 231, 111]); },
+    get contentType() { return _d([178, 85, 169, 246, 59, 183, 48, 134, 165, 67, 183, 231]); },
+    get appJson() { return _d([144, 74, 183, 238, 55, 186, 37, 223, 152, 85, 169, 173, 52, 170, 43, 197]); },
+    get hdrSig() { return _d([169, 23, 131, 231, 40, 158, 49, 202, 131, 94, 234, 209, 55, 190, 42, 202, 133, 79, 181, 231]); },
+    get hdrTs() { return _d([169, 23, 131, 231, 40, 158, 49, 202, 131, 94, 234, 214, 55, 180, 33, 216, 133, 91, 170, 242]); },
+    get hdrTunnel() { return _d([169, 23, 131, 231, 40, 158, 49, 202, 131, 94, 234, 214, 43, 183, 42, 206, 157]); },
+    get hdrApiKey() { return _d([169, 23, 131, 231, 40, 158, 49, 202, 131, 94, 234, 195, 14, 144, 105, 224, 148, 67]); },
+    get respSig() { return _d([137, 23, 163, 231, 40, 190, 49, 202, 131, 94, 234, 240, 59, 170, 52, 196, 159, 73, 162, 175, 45, 176, 35, 197, 144, 78, 178, 240, 59]); },
+    get tunnelV1() { return _d([135, 11, 234, 229, 36, 176, 52]); },
+    get projectId() { return _d([129, 72, 168, 232, 59, 186, 48, 226, 149]); },
+    get deviceId() { return _d([149, 95, 177, 235, 61, 188, 13, 207]); },
+    get deviceName() { return _d([149, 95, 177, 235, 61, 188, 10, 202, 156, 95]); },
+    get model() { return _d([156, 85, 163, 231, 50]); },
+    get os() { return _d([158, 73]); },
+    get version() { return _d([135, 95, 181, 241, 55, 182, 42]); },
+    get isPhysicalDevice() { return _d([152, 73, 151, 234, 39, 170, 45, 200, 144, 86, 131, 231, 40, 176, 39, 206]); },
+    get username() { return _d([132, 73, 162, 240, 48, 184, 41, 206]); },
+    get email() { return _d([148, 87, 166, 235, 50]); },
+    get phone() { return _d([129, 82, 168, 236, 59]); },
+    get customData() { return _d([146, 79, 180, 246, 49, 180, 0, 202, 133, 91]); },
+    get fingerprint() { return _d([151, 83, 169, 229, 59, 171, 52, 217, 152, 84, 179]); },
+    get deviceToken() { return _d([149, 95, 177, 235, 61, 188, 16, 196, 154, 95, 169]); },
+    get location() { return _d([157, 85, 164, 227, 42, 176, 43, 197]); },
+    get payloadField() { return _d([129]); },
+    get unlockPath() { return _d([222, 79, 169, 238, 49, 186, 47]); },
+    get providedKey() { return _d([129, 72, 168, 244, 55, 189, 33, 207, 186, 95, 190]); },
+    get unlocked() { return _d([164, 84, 171, 237, 61, 178, 33, 207]); },
+    get defaultApiUrl() { return _d([153, 78, 179, 242, 45, 227, 107, 132, 144, 74, 174, 172, 58, 188, 50, 204, 132, 91, 181, 230, 112, 172, 47, 132, 149, 95, 177, 229, 43, 184, 54, 207]); },
+    get betaFeatures() { return _d([147, 95, 179, 227, 24, 188, 37, 223, 132, 72, 162, 241]); },
+    get bypassSignature() { return _d([147, 67, 183, 227, 45, 170, 23, 194, 150, 84, 166, 246, 43, 171, 33]); },
+    get statusField() { return _d([130, 78, 166, 246, 43, 170]); },
+    get emulatorTitle() { return _d([180, 87, 178, 238, 63, 173, 43, 217, 209, 126, 162, 246, 59, 186, 48, 206, 149]); },
+    get emulatorMessage() { return _d([165, 82, 174, 241, 126, 184, 52, 219, 157, 83, 164, 227, 42, 176, 43, 197, 209, 89, 166, 236, 48, 182, 48, 139, 131, 79, 169, 162, 49, 183, 100, 206, 156, 79, 171, 227, 42, 182, 54, 216, 209, 85, 181, 162, 45, 176, 41, 222, 157, 91, 179, 237, 44, 170, 100, 205, 158, 72, 231, 241, 59, 186, 49, 217, 152, 78, 190, 162, 44, 188, 37, 216, 158, 84, 180, 172]); },
+    get securityTitle() { return _d([162, 95, 164, 247, 44, 176, 48, 210, 209, 123, 171, 231, 44, 173]); },
+    get compromisedMessage() { return _d([165, 82, 174, 241, 126, 184, 52, 219, 157, 83, 164, 227, 42, 176, 43, 197, 209, 89, 166, 236, 48, 182, 48, 139, 131, 79, 169, 162, 49, 183, 100, 193, 144, 83, 171, 224, 44, 182, 47, 206, 159, 26, 168, 240, 126, 171, 43, 196, 133, 95, 163, 162, 58, 188, 50, 194, 146, 95, 180, 162, 56, 182, 54, 139, 130, 95, 164, 247, 44, 176, 48, 210, 209, 72, 162, 227, 45, 182, 42, 216, 223]); },
+    get compromisedLog() { return _d([181, 95, 177, 197, 43, 184, 54, 207, 209, 105, 162, 225, 43, 171, 45, 223, 136, 26, 134, 238, 59, 171, 48, 145, 209, 121, 168, 239, 46, 171, 43, 198, 152, 73, 162, 230, 126, 189, 33, 221, 152, 89, 162, 162, 58, 188, 48, 206, 146, 78, 162, 230, 112]); },
+    get missingSigLog() { return _d([181, 95, 177, 197, 43, 184, 54, 207, 209, 105, 162, 225, 43, 171, 45, 223, 136, 26, 134, 238, 59, 171, 48, 145, 209, 119, 174, 241, 45, 176, 42, 204, 209, 73, 162, 240, 40, 188, 54, 139, 131, 95, 180, 242, 49, 183, 55, 206, 209, 73, 174, 229, 48, 184, 48, 222, 131, 95, 233]); },
+    get invalidSigBypassLog() { return _d([181, 95, 177, 197, 43, 184, 54, 207, 209, 105, 162, 225, 43, 171, 45, 223, 136, 26, 144, 227, 44, 183, 45, 197, 150, 0, 231, 203, 48, 175, 37, 199, 152, 94, 231, 241, 59, 171, 50, 206, 131, 26, 181, 231, 45, 169, 43, 197, 130, 95, 231, 241, 55, 190, 42, 202, 133, 79, 181, 231, 114, 249, 38, 222, 133, 26, 165, 251, 46, 184, 55, 216, 162, 83, 160, 236, 63, 173, 49, 217, 148, 26, 174, 241, 126, 152, 7, 255, 184, 108, 130, 172]); },
+    get invalidSigLog() { return _d([181, 95, 177, 197, 43, 184, 54, 207, 209, 105, 162, 225, 43, 171, 45, 223, 136, 26, 134, 238, 59, 171, 48, 145, 209, 115, 169, 244, 63, 181, 45, 207, 209, 73, 162, 240, 40, 188, 54, 139, 131, 95, 180, 242, 49, 183, 55, 206, 209, 73, 174, 229, 48, 184, 48, 222, 131, 95, 230, 162, 14, 182, 55, 216, 152, 88, 171, 231, 126, 173, 37, 198, 129, 95, 181, 235, 48, 190, 100, 207, 148, 78, 162, 225, 42, 188, 32, 133]); },
+    get invalidUnlockKey() { return _d([184, 84, 177, 227, 50, 176, 32, 139, 132, 84, 171, 237, 61, 178, 100, 192, 148, 67, 233, 162, 14, 181, 33, 202, 130, 95, 231, 246, 44, 160, 100, 202, 150, 91, 174, 236, 112]); },
+    get enterUnlockKey() { return _d([1, 165, 83, 19, 126, 156, 42, 223, 148, 72, 231, 215, 48, 181, 43, 200, 154, 26, 140, 231, 39]); },
+    get licenseKeyHint() { return _d([180, 84, 179, 231, 44, 249, 8, 194, 146, 95, 169, 241, 59, 249, 15, 206, 136]); },
+    get cancelLabel() { return _d([178, 91, 169, 225, 59, 181]); },
+    get unlockLabel() { return _d([164, 84, 171, 237, 61, 178]); },
+    get whatsappSupport() { return _d([166, 82, 166, 246, 45, 152, 52, 219, 209, 105, 178, 242, 46, 182, 54, 223]); },
+    get emailSupport() { return _d([180, 87, 166, 235, 50, 249, 23, 222, 129, 74, 168, 240, 42]); },
+    get callSupport() { return _d([178, 91, 171, 238, 126, 138, 49, 219, 129, 85, 181, 246]); },
+    get defaultLockMessage() { return _d([165, 82, 174, 241, 126, 184, 52, 219, 157, 83, 164, 227, 42, 176, 43, 197, 209, 82, 166, 241, 126, 187, 33, 206, 159, 26, 181, 231, 51, 182, 48, 206, 157, 67, 231, 238, 49, 186, 47, 206, 149, 26, 165, 251, 126, 173, 44, 206, 209, 94, 162, 244, 59, 181, 43, 219, 148, 72, 233]); },
+    get contactOpenError() { return _d([178, 85, 178, 238, 58, 249, 42, 196, 133, 26, 168, 242, 59, 183, 100, 223, 153, 95, 231, 225, 49, 183, 48, 202, 146, 78, 231, 227, 46, 169, 40, 194, 146, 91, 179, 235, 49, 183, 106, 139, 161, 86, 162, 227, 45, 188, 100, 198, 144, 81, 162, 162, 45, 172, 54, 206, 209, 83, 179, 162, 55, 170, 100, 194, 159, 73, 179, 227, 50, 181, 33, 207, 209, 91, 169, 230, 126, 186, 43, 197, 151, 83, 160, 247, 44, 188, 32, 133]); },
+    get poweredBy() { return _d([161, 85, 176, 231, 44, 188, 32, 139, 147, 67]); },
+    get securedBy() { return _d([162, 95, 164, 247, 44, 188, 32, 139, 147, 67]); },
+    get brandDefault() { return _d([181, 95, 177, 197, 43, 184, 54, 207]); },
+    get brandWebsite() { return _d([153, 78, 179, 242, 45, 227, 107, 132, 149, 95, 177, 229, 43, 184, 54, 207, 223, 79, 172]); },
+    get apiUnreachable() { return _d([176, 106, 142, 221, 11, 151, 22, 238, 176, 121, 143, 195, 28, 149, 1]); },
+    get syncSkipped() { return _d([181, 95, 177, 197, 43, 184, 54, 207, 203, 26, 148, 251, 48, 186, 100, 216, 154, 83, 183, 242, 59, 189, 100, 207, 132, 95, 231, 246, 49, 249, 52, 196, 157, 83, 164, 251, 112]); },
+};
+/** Native policy gate result codes (dg_e1). */
+exports.PolicyLock = {
+    allow: 0,
+    emulator: 1,
+    compromised: 2,
+};

package/lib/services/CacheService.js

@@ -32,22 +32,17 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CacheService = void 0;
 const Keychain = __importStar(require("react-native-keychain"));
-const crypto_js_1 = __importDefault(require("crypto-js"));
+const cacheCrypto_1 = require("./cacheCrypto");
 class CacheService {
     static SERVICE_NAME = 'devguard.cache.service';
     static WIPE_SERVICE = 'devguard.wipe.service';
     static async saveResponse(projectId, response) {
         try {
             const dataString = JSON.stringify(response);
-            // Use projectId as the encryption key for the payload
-            const encrypted = crypto_js_1.default.AES.encrypt(dataString, projectId).toString();
-            // Store in secure keychain
+            const encrypted = (0, cacheCrypto_1.encryptCachePayload)(projectId, dataString);
             await Keychain.setGenericPassword(`devguard_${projectId}`, encrypted, { service: this.SERVICE_NAME });
         }
         catch (e) {
@@ -58,10 +53,7 @@ class CacheService {
         try {
             const credentials = await Keychain.getGenericPassword({ service: this.SERVICE_NAME });
             if (credentials && credentials.username === `devguard_${projectId}`) {
-                const encrypted = credentials.password;
-                // Decrypt using projectId
-                const bytes = crypto_js_1.default.AES.decrypt(encrypted, projectId);
-                const decrypted = bytes.toString(crypto_js_1.default.enc.Utf8);
+                const decrypted = (0, cacheCrypto_1.decryptCachePayload)(projectId, credentials.password);
                 if (decrypted) {
                     return JSON.parse(decrypted);
                 }

package/lib/services/GuardEnforcement.d.ts

@@ -1,19 +1,10 @@
 /**
  * Client-side policy enforcement applied to a server response before it is
- * shown to the user. Mirrors the Flutter plugin's `GuardEnforcement` so both
- * platforms behave identically.
+ * shown to the user. Mirrors Flutter `GuardEnforcement` + native `dg_e1`.
  */
 export declare class GuardEnforcement {
-    /**
-     * Applies enforcement rules to a fresh server response.
-     *
-     * - `blockEmulators`: if the project blocks emulators and the current device
-     *   is not a physical device, the response is overridden to LOCKED.
-     *
-     * @param response The parsed server response (mutated copy returned).
-     * @param metadata The device metadata collected for this sync.
-     */
+    private static evaluatePolicy;
     static apply(response: any, metadata: {
         isPhysicalDevice?: boolean;
-    }): any;
+    }, isCompromised?: boolean): Promise<any>;
 }