react-native-device-integrity 0.1.0 → 0.2.0

package/README.md

@@ -1,6 +1,6 @@
 # react-native-device-integrity
 
-Jailbreak, root, hooking, debugger and emulator detection for React Native and Expo.
+Jailbreak, root, hooking, debugger, emulator and opt-in tamper detection for React Native and Expo.
 
 [![npm version](https://img.shields.io/npm/v/react-native-device-integrity.svg)](https://www.npmjs.com/package/react-native-device-integrity)
 [![npm license](https://img.shields.io/npm/l/react-native-device-integrity.svg)](https://www.npmjs.com/package/react-native-device-integrity)
@@ -10,10 +10,34 @@ Jailbreak, root, hooking, debugger and emulator detection for React Native and E
 
 ## What it does / doesn't
 
-**Does:** report client-side signals for jailbreak/root, hooking frameworks, attached debuggers, and emulator/simulator environments.
+**Does:** report client-side signals for jailbreak/root, hooking frameworks, attached debuggers, emulator/simulator environments, and (opt-in) app tampering indicators.
 
 **Doesn't:** send telemetry, make network calls, or request permissions. Client-side only — **not** a replacement for commercial RASP/anti-tamper products or server-side attestation (App Attest / Play Integrity).
 
+## How it compares
+
+A snapshot of popular options, as of September 2026. Check each project for current details.
+
+| | **react-native-device-integrity** | [jail-monkey](https://github.com/GantMan/jail-monkey) | [freeRASP](https://github.com/talsec/Free-RASP-ReactNative) | [expo-device](https://docs.expo.dev/versions/latest/sdk/device/) | [react-native-device-info](https://github.com/react-native-device-info/react-native-device-info) |
+| --- | --- | --- | --- | --- | --- |
+| Focus | Device integrity signals | Jailbreak/root + device flags | Full RASP / app shielding | Device info | Device info |
+| Jailbreak / root | ✅ | ✅ | ✅ | Experimental (`isRootedExperimentalAsync`) | — |
+| Hooking frameworks (Frida, Xposed, Substrate) | ✅ iOS + Android | Android: suspicious apps | ✅ | — | — |
+| Debugger attached | ✅ | Debug-build check | ✅ | — | — |
+| Emulator / simulator | ✅ (reported separately) | — | ✅ | `isDevice` | `isEmulator()` |
+| App tampering, unofficial store, screenshots, malware… | Signature, installer (Android); encryption, Team ID (iOS) — opt-in | — | ✅ | — | — |
+| Result model | `clean` / `compromised` / `unknown` + signal ids + reason | Booleans | Per-threat callbacks | Boolean / throws | Boolean |
+| Failed checks | Reported as `unknown`, never `clean` | Not documented | Not documented | Throws | Not documented |
+| Network / telemetry | **None** | None | Security telemetry to Talsec (part of the free plan) | None | None |
+| Licence / cost | MIT, fully open source | MIT | MIT wrapper + proprietary SDK; free up to 100k devices | MIT | MIT |
+| Architecture | New Architecture (TurboModule) | New + old architecture | Not documented | Expo module | Not documented |
+| Expo config plugin | ✅ | — | ✅ | Built in (Expo) | — |
+
+**Pick this library** if you want a small, fully open-source, zero-network check with typed, fail-closed results that you can audit end to end.
+**Pick freeRASP** if you need broad RASP coverage (tampering, store, screen capture, malware) and managed reporting, and can accept telemetry and its fair-usage terms.
+**Pick jail-monkey** if you also need its extra device flags (mock location, ADB, developer settings) or old-architecture support.
+None of these replace server-side attestation (App Attest / Play Integrity) for high-value actions.
+
 ## Requirements
 
 - **New Architecture (TurboModule) required** — no old-architecture bridge fallback.
@@ -80,13 +104,25 @@ Android needs no extra setup — the library manifest `<queries>` list merges au
 import {
   checkIntegrity,
   useDeviceIntegrity,
+  SIGNAL_IDS,
 } from 'react-native-device-integrity';
 
 const result = await checkIntegrity({
   treatEmulatorAsCompromised: false,
   timeoutMs: 10_000,
+  ignore: ['debugger_attached'],
+  policy: { compromisingCategories: ['jailbreak', 'root', 'hooking', 'tamper'] },
+  android: {
+    expectedSigningCertificates: ['…sha256 hex…'],
+    allowedInstallers: ['com.android.vending'],
+  },
+  ios: {
+    expectedTeamIds: ['ABCDE12345'],
+    requireEncryptedBinary: true,
+  },
 });
 // result.status: 'clean' | 'compromised' | 'unknown'
+// result.ignored, result.durationMs
 ```
 
 ```tsx
@@ -121,15 +157,25 @@ Never rejects. Failures map to `status: 'unknown'` with a `reason`.
 
 | Option | Default | Description |
 | --- | --- | --- |
-| `treatEmulatorAsCompromised` | `false` | When `true`, emulator/simulator signals make `status` `'compromised'`. When `false`, they are reported but do not compromise. |
+| `treatEmulatorAsCompromised` | `false` | Shorthand that unions `'emulator'` into the compromising category set. When `false`, emulator/simulator signals are reported but do not compromise (unless listed in `policy`). |
 | `timeoutMs` | `10000` | Resolve as `'unknown'` with reason `'timeout'` if native does not answer in time. |
+| `ignore` | `undefined` | `SignalId[]` — matching signals are removed from `signals`, moved to `result.ignored`, and never affect status. |
+| `policy.compromisingCategories` | every category except `'emulator'` | Categories that make status `'compromised'`. When both `policy` and `treatEmulatorAsCompromised` are set, the sets are **unioned**. An empty list means no signal can make the status `'compromised'`; use it only deliberately. |
+| `android.expectedSigningCertificates` | unset | SHA-256 digests of expected signing certificates (hex; colons/whitespace optional). Check runs only when non-empty. |
+| `android.allowedInstallers` | unset | Allowed installer package names. Check runs only when non-empty. A null/unknown installer (e.g. adb/sideload) counts as untrusted. |
+| `ios.expectedTeamIds` | unset | Expected Apple Team IDs. Check runs only when non-empty. |
+| `ios.requireEncryptedBinary` | unset | When `true`, require the main executable to be encrypted. |
+
+Tamper checks run **only** when their option is provided and non-empty (or `true`). Not configured ⇒ the check does not run and does **not** make the report incomplete.
 
 #### `IntegrityResult`
 
 | Field | Type | Description |
 | --- | --- | --- |
 | `status` | `'clean' \| 'compromised' \| 'unknown'` | Resolved status (see [Result semantics](#result-semantics)). |
-| `signals` | `Signal[]` | Detected signals (may be empty). |
+| `signals` | `Signal[]` | Detected signals after `ignore` filtering (may be empty). |
+| `ignored` | `Signal[]` | Signals removed by `ignore` (always present; possibly empty). |
+| `durationMs` | `number` | Wall time of the check measured in JS (`performance.now()` when available, else `Date.now()`). `0` on unsupported platforms. |
 | `platform` | `Platform.OS` | Platform the check ran on. |
 | `reason?` | `UnknownReason` | Present when `status` is `'unknown'`. |
 | `error?` | `string` | Optional message (e.g. native error text). |
@@ -138,15 +184,19 @@ Never rejects. Failures map to `status: 'unknown'` with a `reason`.
 
 | Field | Type |
 | --- | --- |
-| `id` | `string` (stable public API) |
+| `id` | `SignalId \| (string & {})` (autocomplete for known ids; unknown future ids accepted) |
 | `category` | `SignalCategory` |
 | `description` | `string` (generic; never includes matched paths/packages) |
 
+#### `SIGNAL_IDS` / `SignalId`
+
+`SIGNAL_IDS` is a readonly tuple of every known signal id. `SignalId` is `(typeof SIGNAL_IDS)[number]`.
+
 #### `SignalCategory`
 
 `'jailbreak'` | `'root'` | `'hooking'` | `'debugger'` | `'emulator'` | `'tamper'` | `'environment'`
 
-`tamper` is reserved for future checks; no current signal uses it. A native category the JS layer doesn't recognise is reported as `environment`, never dropped.
+A native category the JS layer doesn't recognise is reported as `environment`, never dropped. `tamper` is used by the opt-in tamper checks below.
 
 #### `UnknownReason`
 
@@ -156,7 +206,7 @@ Never rejects. Failures map to `status: 'unknown'` with a `reason`.
 | `native_module_unavailable` | TurboModule is missing / null (wrong arch, Expo Go, failed link). |
 | `native_error` | Native call threw/rejected, or the native report was malformed. |
 | `timeout` | Native did not answer within `timeoutMs`. |
-| `incomplete` | Native finished with `completed: false` (a check threw; compromise evidence still wins if any non-emulator signal is present). |
+| `incomplete` | Native finished with `completed: false` (a check threw; compromise evidence still wins if any non-ignored compromising signal is present). |
 | `not_implemented` | Native report has `completed: false` and `reason: 'not_implemented'` (stub / unfinished native path). |
 
 ### `useDeviceIntegrity(options?)`
@@ -175,6 +225,7 @@ Behaviour:
 
 - Runs on mount.
 - Re-checks when the app returns to the foreground (`background`/`inactive` → `active`).
+- Re-checks when options change **by value** (stable key) — inline object literals with the same contents do not loop.
 - Latest-request-wins (stale responses are ignored).
 - Keeps the previous `result` while refreshing (`loading` is `true`, `result` is not cleared).
 
@@ -182,10 +233,12 @@ Behaviour:
 
 Status is resolved from the native report + options:
 
-1. **Compromise evidence wins** — any non-emulator signal → `'compromised'`, even if the run was incomplete.
-2. Emulator/simulator signals compromise **only** when `treatEmulatorAsCompromised` is `true`.
-3. If the run did not complete (`completed: false`) and there is no compromising evidence → `'unknown'`.
-4. Otherwise → `'clean'`.
+1. Apply `ignore` — matching signals move to `ignored` and never affect status.
+2. Build the compromising category set: `policy.compromisingCategories` if provided, otherwise every category except `'emulator'`. Union `'emulator'` when `treatEmulatorAsCompromised` is `true`.
+3. **Compromise evidence wins** — any non-ignored signal whose category is in that set → `'compromised'`, even if the run was incomplete.
+4. Non-compromising, non-ignored signals (e.g. emulator by default) stay in `signals` but do not change status.
+5. If the run did not complete (`completed: false`) and there is no compromising evidence → `'unknown'`.
+6. Otherwise → `'clean'`.
 
 **`unknown` is never `clean`.** Incomplete, timed-out, missing-module, and unsupported-platform outcomes must not be treated as a safe device.
 
@@ -210,6 +263,51 @@ function IntegrityGate({ children }: { children: React.ReactNode }) {
 }
 ```
 
+## Testing with Jest
+
+Ship a CommonJS mock that never loads native code:
+
+```ts
+jest.mock(
+  'react-native-device-integrity',
+  () => require('react-native-device-integrity/jest')
+);
+```
+
+Helpers:
+
+```ts
+import {
+  checkIntegrity,
+  useDeviceIntegrity,
+  setMockIntegrityResult,
+  resetMockIntegrity,
+  SIGNAL_IDS,
+} from 'react-native-device-integrity/jest';
+
+beforeEach(() => {
+  resetMockIntegrity();
+});
+
+it('blocks compromised devices', async () => {
+  setMockIntegrityResult({
+    status: 'compromised',
+    signals: [
+      {
+        id: 'jailbreak_files',
+        category: 'jailbreak',
+        description: 'Unexpected system paths',
+      },
+    ],
+  });
+
+  const result = await checkIntegrity();
+  expect(result.status).toBe('compromised');
+});
+```
+
+`setMockIntegrityResult(partial)` merges onto a default clean result (`status: 'clean'`, empty `signals` / `ignored`, `platform: 'ios'`, `durationMs: 0`). `useDeviceIntegrity` returns `{ status, signals, result, loading: false, refresh }` from the current mock result.
+
 ## Signal reference
 
 Descriptions are generic on purpose (no matched paths or package names).
@@ -226,6 +324,8 @@ Descriptions are generic on purpose (no matched paths or package names).
 | `hooking_libraries` | `hooking` | Suspicious dynamic libraries are loaded. |
 | `hooking_dyld_insert` | `hooking` | `DYLD_INSERT_LIBRARIES` is set in the process environment. |
 | `debugger_attached` | `debugger` | A debugger is attached to the process. |
+| `tamper_binary_decrypted` | `tamper` | Main executable encryption (`LC_ENCRYPTION_INFO`) reports decrypted / missing (opt-in). |
+| `tamper_team_id_mismatch` | `tamper` | App Team ID is not in `expectedTeamIds` (opt-in). |
 
 ### Android
 
@@ -241,6 +341,33 @@ Descriptions are generic on purpose (no matched paths or package names).
 | `hooking_frida` | `hooking` | Instrumentation framework artifacts were detected. |
 | `hooking_xposed` | `hooking` | Code-injection framework artifacts were detected. |
 | `debugger_attached` | `debugger` | A debugger is attached to the process. |
+| `tamper_signature_mismatch` | `tamper` | None of the app's signing certificates match `expectedSigningCertificates` (opt-in). |
+| `tamper_untrusted_installer` | `tamper` | Installer package is not in `allowedInstallers` (opt-in; null/unknown counts as untrusted). |
+
+### Tamper checks (opt-in)
+
+These checks run only when you pass the corresponding options. They do not run by default and do not make an otherwise complete report incomplete.
+
+**Android — signing certificates**
+
+- Get the SHA-256 of the signing certificate with `keytool -printcert -jarfile app.apk`, or from Play Console → App signing → “App signing key certificate” SHA-256.
+- For Play Store builds, use the **Play App Signing** key digest (not necessarily the upload key).
+- Digests are hex, case-insensitive; colons and whitespace are optional (normalized before compare).
+
+**Android — allowed installers**
+
+- Typical Play Store value: `com.android.vending`.
+- A null/unknown installer (adb / sideload) is treated as untrusted.
+- **Only enable in release builds** — debug installs via adb will always fail this check.
+
+**iOS — Team ID**
+
+- Use the Team ID from your [Apple Developer](https://developer.apple.com/account) account (the keychain access-group prefix).
+
+**iOS — encrypted binary**
+
+- `requireEncryptedBinary: true` is appropriate for **App Store / TestFlight** builds only.
+- **Never** enable for debug, development, or ad-hoc builds (those binaries are typically unencrypted).
 
 ### Notes
 

package/android/src/main/java/com/deviceintegrity/DeviceIntegrityModule.kt

@@ -3,6 +3,9 @@ package com.deviceintegrity
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableArray
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.ReadableType
 import com.facebook.react.bridge.WritableArray
 import com.facebook.react.bridge.WritableMap
 import java.util.concurrent.Executors
@@ -10,10 +13,11 @@ import java.util.concurrent.Executors
 class DeviceIntegrityModule(reactContext: ReactApplicationContext) :
   NativeDeviceIntegritySpec(reactContext) {
 
-  override fun checkIntegrity(promise: Promise) {
+  override fun checkIntegrity(options: ReadableMap, promise: Promise) {
     executor.execute {
       try {
-        val report = IntegrityChecks(reactApplicationContext).run()
+        val androidOptions = parseAndroidOptions(options)
+        val report = IntegrityChecks(reactApplicationContext).run(androidOptions)
         promise.resolve(toWritableMap(report))
       } catch (t: Throwable) {
         promise.reject("E_INTEGRITY", t.message ?: "Unexpected integrity check failure", t)
@@ -28,6 +32,68 @@ class DeviceIntegrityModule(reactContext: ReactApplicationContext) :
       Thread(runnable, "DeviceIntegrityChecks").apply { isDaemon = true }
     }
 
+    /**
+     * Defensive parse of `options.android`. Missing keys, nulls, and wrong types
+     * are treated as not configured (empty lists).
+     */
+    internal fun parseAndroidOptions(options: ReadableMap?): AndroidTamperOptions {
+      if (options == null || !options.hasKey("android") || options.isNull("android")) {
+        return AndroidTamperOptions()
+      }
+      if (options.getType("android") != ReadableType.Map) {
+        return AndroidTamperOptions()
+      }
+
+      val android =
+        try {
+          options.getMap("android")
+        } catch (_: Throwable) {
+          null
+        } ?: return AndroidTamperOptions()
+
+      return AndroidTamperOptions(
+        expectedSigningCertificates =
+          readStringList(android, "expectedSigningCertificates"),
+        allowedInstallers = readStringList(android, "allowedInstallers"),
+      )
+    }
+
+    private fun readStringList(map: ReadableMap, key: String): List<String> {
+      if (!map.hasKey(key) || map.isNull(key)) {
+        return emptyList()
+      }
+      if (map.getType(key) != ReadableType.Array) {
+        return emptyList()
+      }
+
+      val array: ReadableArray =
+        try {
+          map.getArray(key)
+        } catch (_: Throwable) {
+          null
+        } ?: return emptyList()
+
+      val result = ArrayList<String>(array.size())
+      for (i in 0 until array.size()) {
+        if (array.isNull(i)) {
+          continue
+        }
+        if (array.getType(i) != ReadableType.String) {
+          continue
+        }
+        val value =
+          try {
+            array.getString(i)
+          } catch (_: Throwable) {
+            null
+          }
+        if (value != null) {
+          result.add(value)
+        }
+      }
+      return result
+    }
+
     private fun toWritableMap(report: IntegrityChecks.Report): WritableMap {
       val map = Arguments.createMap()
       map.putBoolean("completed", report.completed)

package/android/src/main/java/com/deviceintegrity/IntegrityChecks.kt

@@ -26,7 +26,7 @@ internal class IntegrityChecks(private val context: Context) {
     val signals: List<Signal>,
   )
 
-  fun run(): Report {
+  fun run(androidOptions: AndroidTamperOptions = AndroidTamperOptions()): Report {
     val signals = mutableListOf<Signal>()
     val seen = mutableSetOf<String>()
     var completed = true
@@ -56,6 +56,10 @@ internal class IntegrityChecks(private val context: Context) {
     runCheck { checkHookingXposed() }
     runCheck { checkDebuggerAttached() }
 
+    val tamper = TamperChecks(context, androidOptions)
+    runCheck { tamper.checkSignatureMismatch() }
+    runCheck { tamper.checkUntrustedInstaller() }
+
     return Report(
       completed = completed,
       reason = if (completed) null else "incomplete",

package/android/src/main/java/com/deviceintegrity/TamperChecks.kt

@@ -0,0 +1,158 @@
+package com.deviceintegrity
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.content.pm.Signature
+import android.os.Build
+import java.security.MessageDigest
+
+/**
+ * Android tamper signals (signing certificate + install source).
+ *
+ * Independent implementation informed by OWASP MASTG
+ * (MASTG-TEST-0038-style signature verification / install source checks);
+ * no code copied.
+ */
+internal data class AndroidTamperOptions(
+  val expectedSigningCertificates: List<String> = emptyList(),
+  val allowedInstallers: List<String> = emptyList(),
+)
+
+internal class TamperChecks(
+  private val context: Context,
+  private val options: AndroidTamperOptions,
+) {
+
+  fun checkSignatureMismatch(): IntegrityChecks.Signal? {
+    if (options.expectedSigningCertificates.isEmpty()) {
+      return null
+    }
+
+    val expected =
+      options.expectedSigningCertificates
+        .map { normalizeCertDigest(it) }
+        .filter { it.isNotEmpty() }
+        .toSet()
+    // Configured but no usable digest (e.g. blank values): the check cannot run.
+    // Throwing marks the report incomplete instead of silently passing.
+    if (expected.isEmpty()) {
+      throw IllegalArgumentException("expectedSigningCertificates contains no usable digest")
+    }
+
+    val current = currentSigningDigests()
+    if (current.any { digest -> digest in expected }) {
+      return null
+    }
+
+    return IntegrityChecks.Signal(
+      id = "tamper_signature_mismatch",
+      category = "tamper",
+      description = "App signing certificate does not match the expected certificate",
+    )
+  }
+
+  fun checkUntrustedInstaller(): IntegrityChecks.Signal? {
+    if (options.allowedInstallers.isEmpty()) {
+      return null
+    }
+
+    val allowed =
+      options.allowedInstallers
+        .filter { it.isNotEmpty() }
+        .toSet()
+    // Configured but only blank values: the check cannot run, so report incomplete.
+    if (allowed.isEmpty()) {
+      throw IllegalArgumentException("allowedInstallers contains no usable package name")
+    }
+
+    val installer = installingPackageName()
+
+    if (!installer.isNullOrEmpty() && installer in allowed) {
+      return null
+    }
+
+    return IntegrityChecks.Signal(
+      id = "tamper_untrusted_installer",
+      category = "tamper",
+      description = "The app was installed from an untrusted source",
+    )
+  }
+
+  private fun installingPackageName(): String? {
+    val pm = context.packageManager
+    val packageName = context.packageName
+    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+      pm.getInstallSourceInfo(packageName).installingPackageName
+    } else {
+      @Suppress("DEPRECATION")
+      pm.getInstallerPackageName(packageName)
+    }
+  }
+
+  private fun currentSigningDigests(): Set<String> {
+    val pm = context.packageManager
+    val packageName = context.packageName
+
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+      val packageInfo =
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+          pm.getPackageInfo(
+            packageName,
+            PackageManager.PackageInfoFlags.of(
+              PackageManager.GET_SIGNING_CERTIFICATES.toLong(),
+            ),
+          )
+        } else {
+          @Suppress("DEPRECATION")
+          pm.getPackageInfo(packageName, PackageManager.GET_SIGNING_CERTIFICATES)
+        }
+
+      val signingInfo =
+        packageInfo.signingInfo
+          ?: throw IllegalStateException("signingInfo unavailable")
+
+      val signatures: Array<Signature> =
+        if (signingInfo.hasMultipleSigners()) {
+          signingInfo.apkContentsSigners
+            ?: throw IllegalStateException("apkContentsSigners unavailable")
+        } else {
+          val history =
+            signingInfo.signingCertificateHistory
+              ?: throw IllegalStateException("signingCertificateHistory unavailable")
+          if (history.isEmpty()) {
+            throw IllegalStateException("signingCertificateHistory empty")
+          }
+          // Last entry is the current signing key (supports key rotation).
+          arrayOf(history.last())
+        }
+
+      return signatures.map { sha256Hex(it.toByteArray()) }.toSet()
+    }
+
+    @Suppress("DEPRECATION")
+    val packageInfo = pm.getPackageInfo(packageName, PackageManager.GET_SIGNATURES)
+    @Suppress("DEPRECATION")
+    val signatures =
+      packageInfo.signatures
+        ?: throw IllegalStateException("signatures unavailable")
+    if (signatures.isEmpty()) {
+      throw IllegalStateException("signatures empty")
+    }
+
+    return signatures.map { sha256Hex(it.toByteArray()) }.toSet()
+  }
+
+  companion object {
+    internal fun normalizeCertDigest(value: String): String =
+      value.replace(":", "").replace(Regex("\\s+"), "").lowercase()
+
+    private fun sha256Hex(bytes: ByteArray): String {
+      val digest = MessageDigest.getInstance("SHA-256").digest(bytes)
+      return buildString(digest.size * 2) {
+        for (b in digest) {
+          append("%02x".format(b))
+        }
+      }
+    }
+  }
+}

package/ios/DIIntegrityChecks.h

@@ -5,10 +5,16 @@ NS_ASSUME_NONNULL_BEGIN
 /**
  * Internal integrity checks. Runs off the main thread (except URL-scheme
  * queries) and delivers a NativeIntegrityReport-shaped dictionary.
+ *
+ * @param iosConfig Optional parsed `ios` options. Keys:
+ *   - expectedTeamIds: NSArray of NSString
+ *   - requireEncryptedBinary: @YES
+ *   Nil/empty ⇒ no tamper checks run (and the report is not incomplete).
  */
 @interface DIIntegrityChecks : NSObject
 
-+ (void)runWithCompletion:(void (^)(NSDictionary *report))completion;
++ (void)runWithIOSConfig:(nullable NSDictionary *)iosConfig
+              completion:(void (^)(NSDictionary *report))completion;
 
 @end
 

package/ios/DIIntegrityChecks.m

@@ -1,6 +1,7 @@
 // Check set informed by IOSSecuritySuite and the OWASP MASTG; independent implementation.
 
 #import "DIIntegrityChecks.h"
+#import "DITamperChecks.h"
 
 #import <UIKit/UIKit.h>
 #import <mach-o/dyld.h>
@@ -54,7 +55,8 @@
   return [report copy];
 }
 
-+ (void)runWithCompletion:(void (^)(NSDictionary *report))completion
++ (void)runWithIOSConfig:(NSDictionary *)iosConfig
+              completion:(void (^)(NSDictionary *report))completion
 {
   dispatch_async(dispatch_get_global_queue(QOS_CLASS_USER_INITIATED, 0), ^{
     NSMutableArray<NSDictionary *> *signals = [NSMutableArray array];
@@ -95,6 +97,12 @@
       completed = NO;
     }
 
+    // --- tamper checks (optional; skipped on Simulator by design) ---
+    [DITamperChecks runWithConfig:iosConfig
+                          signals:signals
+                          seenIds:seenIds
+                        completed:&completed];
+
 #if TARGET_OS_SIMULATOR
     // Simulator: host Mac filesystem and Xcode-injected DYLD_INSERT_LIBRARIES
     // make jailbreak / dyld-insert checks meaningless — skip by design.

package/ios/DITamperChecks.h

@@ -0,0 +1,27 @@
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * Independent implementation informed by OWASP MASTG (MASVS-RESILIENCE-2
+ * app integrity); no code copied.
+ *
+ * Optional tamper checks driven by the `ios` options object. A check runs
+ * only when its option is configured; unconfigured checks are skipped and
+ * do not mark the report incomplete. On the Simulator, configured checks
+ * are skipped by design (not incomplete).
+ *
+ * Config keys (all optional):
+ * - expectedTeamIds: NSArray of NSString (non-empty ⇒ run team-id check)
+ * - requireEncryptedBinary: @YES ⇒ run binary-encryption check
+ */
+@interface DITamperChecks : NSObject
+
++ (void)runWithConfig:(nullable NSDictionary *)config
+              signals:(NSMutableArray<NSDictionary *> *)signals
+              seenIds:(NSMutableSet<NSString *> *)seenIds
+            completed:(BOOL *)completed;
+
+@end
+
+NS_ASSUME_NONNULL_END