react-native-device-integrity 0.1.0

package/ios/DIIntegrityChecks.m

@@ -0,0 +1,395 @@
+// Check set informed by IOSSecuritySuite and the OWASP MASTG; independent implementation.
+
+#import "DIIntegrityChecks.h"
+
+#import <UIKit/UIKit.h>
+#import <mach-o/dyld.h>
+#import <sys/sysctl.h>
+#import <unistd.h>
+
+@interface DIIntegrityChecks ()
++ (void)addSignalId:(NSString *)signalId
+            category:(NSString *)category
+         description:(NSString *)description
+             signals:(NSMutableArray<NSDictionary *> *)signals
+             seenIds:(NSMutableSet<NSString *> *)seenIds;
++ (BOOL)pathExists:(NSString *)path;
++ (BOOL)hasJailbreakFiles;
++ (BOOL)hasJailbreakURLSchemes;
++ (BOOL)hasJailbreakSymlinks;
++ (BOOL)isSystemWritable;
++ (BOOL)hasHookingLibraries;
++ (BOOL)hasDyldInsertLibraries;
++ (BOOL)isDebuggerAttached;
+@end
+
+@implementation DIIntegrityChecks
+
++ (void)addSignalId:(NSString *)signalId
+            category:(NSString *)category
+         description:(NSString *)description
+             signals:(NSMutableArray<NSDictionary *> *)signals
+             seenIds:(NSMutableSet<NSString *> *)seenIds
+{
+  if ([seenIds containsObject:signalId]) {
+    return;
+  }
+  [seenIds addObject:signalId];
+  [signals addObject:@{
+    @"id" : signalId,
+    @"category" : category,
+    @"description" : description,
+  }];
+}
+
++ (NSDictionary *)buildReportWithSignals:(NSArray *)signals completed:(BOOL)completed
+{
+  NSMutableDictionary *report = [@{
+    @"completed" : @(completed),
+    @"signals" : signals,
+  } mutableCopy];
+  if (!completed) {
+    report[@"reason"] = @"incomplete";
+  }
+  return [report copy];
+}
+
++ (void)runWithCompletion:(void (^)(NSDictionary *report))completion
+{
+  dispatch_async(dispatch_get_global_queue(QOS_CLASS_USER_INITIATED, 0), ^{
+    NSMutableArray<NSDictionary *> *signals = [NSMutableArray array];
+    NSMutableSet<NSString *> *seenIds = [NSMutableSet set];
+    __block BOOL completed = YES;
+
+#if TARGET_OS_SIMULATOR
+    [self addSignalId:@"simulator"
+             category:@"emulator"
+          description:@"Running on the iOS Simulator"
+              signals:signals
+              seenIds:seenIds];
+#endif
+
+    // --- hooking_libraries (always) ---
+    @try {
+      if ([self hasHookingLibraries]) {
+        [self addSignalId:@"hooking_libraries"
+                 category:@"hooking"
+              description:@"Suspicious dynamic libraries are loaded"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+    // --- debugger_attached (always) ---
+    @try {
+      if ([self isDebuggerAttached]) {
+        [self addSignalId:@"debugger_attached"
+                 category:@"debugger"
+              description:@"A debugger is attached to the process"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+#if TARGET_OS_SIMULATOR
+    // Simulator: host Mac filesystem and Xcode-injected DYLD_INSERT_LIBRARIES
+    // make jailbreak / dyld-insert checks meaningless — skip by design.
+    // Skipped-by-design is not incomplete.
+    completion([self buildReportWithSignals:[signals copy] completed:completed]);
+#else
+    @try {
+      if ([self hasJailbreakFiles]) {
+        [self addSignalId:@"jailbreak_files"
+                 category:@"jailbreak"
+              description:@"Unexpected system paths associated with jailbreaks were found"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+    @try {
+      if ([self hasJailbreakSymlinks]) {
+        [self addSignalId:@"jailbreak_symlinks"
+                 category:@"jailbreak"
+              description:@"Unexpected symbolic links were found in system locations"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+    @try {
+      if ([self isSystemWritable]) {
+        [self addSignalId:@"jailbreak_writable_system"
+                 category:@"jailbreak"
+              description:@"A normally read-only system location is writable"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+    @try {
+      if ([self hasDyldInsertLibraries]) {
+        [self addSignalId:@"hooking_dyld_insert"
+                 category:@"hooking"
+              description:@"DYLD_INSERT_LIBRARIES is set in the process environment"
+                  signals:signals
+                  seenIds:seenIds];
+      }
+    } @catch (__unused NSException *exception) {
+      completed = NO;
+    }
+
+    // canOpenURL: must run on the main thread.
+    // These schemes need LSApplicationQueriesSchemes (added by the Expo config
+    // plugin in Phase 3 / documented for bare apps); without it canOpenURL
+    // just returns NO.
+    dispatch_async(dispatch_get_main_queue(), ^{
+      @try {
+        if ([self hasJailbreakURLSchemes]) {
+          [self addSignalId:@"jailbreak_url_schemes"
+                   category:@"jailbreak"
+                description:@"Jailbreak-related URL schemes are registered"
+                    signals:signals
+                    seenIds:seenIds];
+        }
+      } @catch (__unused NSException *exception) {
+        completed = NO;
+      }
+
+      completion([self buildReportWithSignals:[signals copy] completed:completed]);
+    });
+#endif
+  });
+}
+
+#pragma mark - Individual checks
+
++ (BOOL)pathExists:(NSString *)path
+{
+  if ([[NSFileManager defaultManager] fileExistsAtPath:path]) {
+    return YES;
+  }
+  const char *cPath = [path fileSystemRepresentation];
+  if (cPath == NULL) {
+    return NO;
+  }
+  return access(cPath, F_OK) == 0;
+}
+
++ (BOOL)hasJailbreakFiles
+{
+  static NSArray<NSString *> *paths = nil;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    paths = @[
+      @"/Applications/Cydia.app",
+      @"/Applications/Sileo.app",
+      @"/Applications/Zebra.app",
+      @"/Applications/Filza.app",
+      @"/Applications/Installer.app",
+      @"/Applications/Undecimus.app",
+      @"/Applications/blackra1n.app",
+      @"/Applications/FakeCarrier.app",
+      @"/Applications/Icy.app",
+      @"/Applications/IntelliScreen.app",
+      @"/Applications/MxTube.app",
+      @"/Applications/RockApp.app",
+      @"/Applications/SBSettings.app",
+      @"/Applications/WinterBoard.app",
+      @"/Library/MobileSubstrate/MobileSubstrate.dylib",
+      @"/Library/MobileSubstrate/DynamicLibraries",
+      @"/usr/lib/libsubstrate.dylib",
+      @"/usr/lib/substitute-inserter.dylib",
+      @"/usr/lib/libhooker.dylib",
+      @"/usr/lib/TweakInject",
+      @"/usr/lib/libellekit.dylib",
+      @"/usr/lib/ellekit/libinjector.dylib",
+      @"/private/var/lib/apt",
+      @"/private/var/lib/apt/",
+      @"/private/var/lib/cydia",
+      @"/private/var/mobile/Library/SBSettings/Themes",
+      @"/private/var/stash",
+      @"/private/var/tmp/cydia.log",
+      @"/private/var/db/stash",
+      @"/usr/sbin/sshd",
+      @"/usr/bin/ssh",
+      @"/usr/bin/sshd",
+      @"/usr/libexec/cydia",
+      @"/usr/libexec/sftp-server",
+      @"/usr/libexec/ssh-keysign",
+      @"/bin/bash",
+      @"/etc/apt",
+      @"/etc/ssh/sshd_config",
+      @"/var/jb",
+      @"/var/binpack",
+      @"/var/checkra1n.dmg",
+      @"/.bootstrapped",
+      @"/.installed_unc0ver",
+      @"/.cydia_no_stash",
+      @"/jb/amfid_payload.dylib",
+      @"/jb/jailbreakd.plist",
+      @"/jb/libjailbreak.dylib",
+      @"/chimera/jailbreakd.plist",
+      @"/odyssey/jailbreakd.plist",
+    ];
+  });
+
+  for (NSString *path in paths) {
+    if ([self pathExists:path]) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
++ (BOOL)hasJailbreakURLSchemes
+{
+  // Requires LSApplicationQueriesSchemes entries; without them canOpenURL
+  // returns NO even when the target app is installed.
+  static NSArray<NSString *> *schemes = nil;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    schemes = @[
+      @"cydia://",
+      @"sileo://",
+      @"zbra://",
+      @"filza://",
+      @"undecimus://",
+      @"activator://",
+    ];
+  });
+
+  UIApplication *app = [UIApplication sharedApplication];
+  for (NSString *scheme in schemes) {
+    NSURL *url = [NSURL URLWithString:scheme];
+    if (url != nil && [app canOpenURL:url]) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
++ (BOOL)hasJailbreakSymlinks
+{
+  static NSArray<NSString *> *paths = nil;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    paths = @[
+      @"/Applications",
+      @"/Library/Ringtones",
+      @"/Library/Wallpaper",
+      @"/usr/arm-apple-darwin9",
+      @"/usr/include",
+      @"/usr/libexec",
+      @"/usr/share",
+    ];
+  });
+
+  NSFileManager *fm = [NSFileManager defaultManager];
+  for (NSString *path in paths) {
+    NSError *error = nil;
+    NSString *destination =
+        [fm destinationOfSymbolicLinkAtPath:path error:&error];
+    if (destination != nil) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
++ (BOOL)isSystemWritable
+{
+  NSString *probeName =
+      [NSString stringWithFormat:@"di_integrity_%@", [[NSUUID UUID] UUIDString]];
+  NSString *probePath = [@"/private/" stringByAppendingPathComponent:probeName];
+  const char *cPath = [probePath fileSystemRepresentation];
+  if (cPath == NULL) {
+    return NO;
+  }
+
+  FILE *file = fopen(cPath, "w");
+  if (file == NULL) {
+    return NO;
+  }
+  fputs("x", file);
+  fclose(file);
+  unlink(cPath);
+  return YES;
+}
+
++ (BOOL)hasHookingLibraries
+{
+  static NSArray<NSString *> *needles = nil;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    needles = @[
+      @"frida",
+      @"fridagadget",
+      @"cynject",
+      @"libcycript",
+      @"mobilesubstrate",
+      @"substrateloader",
+      @"substrateinserter",
+      @"substitute",
+      @"libhooker",
+      @"ellekit",
+      @"tweakinject",
+      @"sslkillswitch",
+      @"revealserver",
+      @"systemhook",
+    ];
+  });
+
+  uint32_t count = _dyld_image_count();
+  for (uint32_t i = 0; i < count; i++) {
+    const char *imageName = _dyld_get_image_name(i);
+    if (imageName == NULL) {
+      continue;
+    }
+    NSString *name =
+        [[NSString stringWithUTF8String:imageName] lowercaseString];
+    if (name == nil) {
+      continue;
+    }
+    for (NSString *needle in needles) {
+      if ([name rangeOfString:needle].location != NSNotFound) {
+        return YES;
+      }
+    }
+  }
+  return NO;
+}
+
++ (BOOL)hasDyldInsertLibraries
+{
+  const char *value = getenv("DYLD_INSERT_LIBRARIES");
+  if (value == NULL) {
+    return NO;
+  }
+  return value[0] != '\0';
+}
+
++ (BOOL)isDebuggerAttached
+{
+  int mib[4] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()};
+  struct kinfo_proc info;
+  memset(&info, 0, sizeof(info));
+  size_t size = sizeof(info);
+
+  if (sysctl(mib, 4, &info, &size, NULL, 0) != 0) {
+    return NO;
+  }
+  return (info.kp_proc.p_flag & P_TRACED) != 0;
+}
+
+@end

package/ios/DeviceIntegrity.h

@@ -0,0 +1,5 @@
+#import <DeviceIntegritySpec/DeviceIntegritySpec.h>
+
+@interface DeviceIntegrity : NSObject <NativeDeviceIntegritySpec>
+
+@end

package/ios/DeviceIntegrity.mm

@@ -0,0 +1,29 @@
+#import "DeviceIntegrity.h"
+#import "DIIntegrityChecks.h"
+
+@implementation DeviceIntegrity
+
+- (std::shared_ptr<facebook::react::TurboModule>)getTurboModule:
+    (const facebook::react::ObjCTurboModule::InitParams &)params
+{
+    return std::make_shared<facebook::react::NativeDeviceIntegritySpecJSI>(params);
+}
+
++ (NSString *)moduleName
+{
+  return @"DeviceIntegrity";
+}
+
+- (void)checkIntegrity:(RCTPromiseResolveBlock)resolve
+                reject:(RCTPromiseRejectBlock)reject
+{
+  @try {
+    [DIIntegrityChecks runWithCompletion:^(NSDictionary *report) {
+      resolve(report);
+    }];
+  } @catch (NSException *exception) {
+    reject(@"E_INTEGRITY", exception.reason ?: @"Unexpected integrity check failure", nil);
+  }
+}
+
+@end

package/ios/PrivacyInfo.xcprivacy

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>NSPrivacyTracking</key>
+	<false/>
+	<key>NSPrivacyTrackingDomains</key>
+	<array/>
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array/>
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array/>
+</dict>
+</plist>

package/lib/module/NativeDeviceIntegrity.js

@@ -0,0 +1,5 @@
+"use strict";
+
+import { TurboModuleRegistry } from 'react-native';
+export default TurboModuleRegistry.get('DeviceIntegrity');
+//# sourceMappingURL=NativeDeviceIntegrity.js.map

package/lib/module/NativeDeviceIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["TurboModuleRegistry","get"],"sourceRoot":"../../src","sources":["NativeDeviceIntegrity.ts"],"mappings":";;AAAA,SAASA,mBAAmB,QAA0B,cAAc;AAkBpE,eAAeA,mBAAmB,CAACC,GAAG,CAAO,iBAAiB,CAAC","ignoreList":[]}

package/lib/module/checkIntegrity.js

@@ -0,0 +1,15 @@
+"use strict";
+
+import { Platform } from 'react-native';
+/**
+ * Web / unsupported-platform entry. Must not import the native TurboModule.
+ */
+export async function checkIntegrity(_options) {
+  return {
+    status: 'unknown',
+    signals: [],
+    platform: Platform.OS,
+    reason: 'unsupported_platform'
+  };
+}
+//# sourceMappingURL=checkIntegrity.js.map

package/lib/module/checkIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Platform","checkIntegrity","_options","status","signals","platform","OS","reason"],"sourceRoot":"../../src","sources":["checkIntegrity.ts"],"mappings":";;AAAA,SAASA,QAAQ,QAAQ,cAAc;AAGvC;AACA;AACA;AACA,OAAO,eAAeC,cAAcA,CAClCC,QAAgC,EACN;EAC1B,OAAO;IACLC,MAAM,EAAE,SAAS;IACjBC,OAAO,EAAE,EAAE;IACXC,QAAQ,EAAEL,QAAQ,CAACM,EAAE;IACrBC,MAAM,EAAE;EACV,CAAC;AACH","ignoreList":[]}

package/lib/module/checkIntegrity.native.js

@@ -0,0 +1,67 @@
+"use strict";
+
+import { Platform } from 'react-native';
+import NativeDeviceIntegrity from "./NativeDeviceIntegrity.js";
+import { resolveStatus } from "./resolveStatus.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+class IntegrityTimeoutError extends Error {
+  constructor() {
+    super('Device integrity check timed out');
+    this.name = 'IntegrityTimeoutError';
+  }
+}
+function withTimeout(promise, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new IntegrityTimeoutError());
+    }, timeoutMs);
+    promise.then(value => {
+      clearTimeout(timer);
+      resolve(value);
+    }, error => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+export async function checkIntegrity(options = {}) {
+  if (Platform.OS !== 'ios' && Platform.OS !== 'android') {
+    return {
+      status: 'unknown',
+      signals: [],
+      platform: Platform.OS,
+      reason: 'unsupported_platform'
+    };
+  }
+  if (NativeDeviceIntegrity == null) {
+    return {
+      status: 'unknown',
+      signals: [],
+      platform: Platform.OS,
+      reason: 'native_module_unavailable'
+    };
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  try {
+    const report = await withTimeout(NativeDeviceIntegrity.checkIntegrity(), timeoutMs);
+    return resolveStatus(report, options, Platform.OS);
+  } catch (error) {
+    if (error instanceof IntegrityTimeoutError) {
+      return {
+        status: 'unknown',
+        signals: [],
+        platform: Platform.OS,
+        reason: 'timeout'
+      };
+    }
+    const message = error instanceof Error ? error.message : typeof error === 'string' ? error : 'Native integrity check failed';
+    return {
+      status: 'unknown',
+      signals: [],
+      platform: Platform.OS,
+      reason: 'native_error',
+      error: message
+    };
+  }
+}
+//# sourceMappingURL=checkIntegrity.native.js.map

package/lib/module/checkIntegrity.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Platform","NativeDeviceIntegrity","resolveStatus","DEFAULT_TIMEOUT_MS","IntegrityTimeoutError","Error","constructor","name","withTimeout","promise","timeoutMs","Promise","resolve","reject","timer","setTimeout","then","value","clearTimeout","error","checkIntegrity","options","OS","status","signals","platform","reason","report","message"],"sourceRoot":"../../src","sources":["checkIntegrity.native.ts"],"mappings":";;AAAA,SAASA,QAAQ,QAAQ,cAAc;AACvC,OAAOC,qBAAqB,MAAM,4BAAyB;AAC3D,SAASC,aAAa,QAAQ,oBAAiB;AAG/C,MAAMC,kBAAkB,GAAG,MAAM;AAEjC,MAAMC,qBAAqB,SAASC,KAAK,CAAC;EACxCC,WAAWA,CAAA,EAAG;IACZ,KAAK,CAAC,kCAAkC,CAAC;IACzC,IAAI,CAACC,IAAI,GAAG,uBAAuB;EACrC;AACF;AAEA,SAASC,WAAWA,CAAIC,OAAmB,EAAEC,SAAiB,EAAc;EAC1E,OAAO,IAAIC,OAAO,CAAI,CAACC,OAAO,EAAEC,MAAM,KAAK;IACzC,MAAMC,KAAK,GAAGC,UAAU,CAAC,MAAM;MAC7BF,MAAM,CAAC,IAAIT,qBAAqB,CAAC,CAAC,CAAC;IACrC,CAAC,EAAEM,SAAS,CAAC;IAEbD,OAAO,CAACO,IAAI,CACTC,KAAK,IAAK;MACTC,YAAY,CAACJ,KAAK,CAAC;MACnBF,OAAO,CAACK,KAAK,CAAC;IAChB,CAAC,EACAE,KAAc,IAAK;MAClBD,YAAY,CAACJ,KAAK,CAAC;MACnBD,MAAM,CAACM,KAAK,CAAC;IACf,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEA,OAAO,eAAeC,cAAcA,CAClCC,OAA8B,GAAG,CAAC,CAAC,EACT;EAC1B,IAAIrB,QAAQ,CAACsB,EAAE,KAAK,KAAK,IAAItB,QAAQ,CAACsB,EAAE,KAAK,SAAS,EAAE;IACtD,OAAO;MACLC,MAAM,EAAE,SAAS;MACjBC,OAAO,EAAE,EAAE;MACXC,QAAQ,EAAEzB,QAAQ,CAACsB,EAAE;MACrBI,MAAM,EAAE;IACV,CAAC;EACH;EAEA,IAAIzB,qBAAqB,IAAI,IAAI,EAAE;IACjC,OAAO;MACLsB,MAAM,EAAE,SAAS;MACjBC,OAAO,EAAE,EAAE;MACXC,QAAQ,EAAEzB,QAAQ,CAACsB,EAAE;MACrBI,MAAM,EAAE;IACV,CAAC;EACH;EAEA,MAAMhB,SAAS,GAAGW,OAAO,CAACX,SAAS,IAAIP,kBAAkB;EAEzD,IAAI;IACF,MAAMwB,MAAM,GAAG,MAAMnB,WAAW,CAC9BP,qBAAqB,CAACmB,cAAc,CAAC,CAAC,EACtCV,SACF,CAAC;IACD,OAAOR,aAAa,CAACyB,MAAM,EAAEN,OAAO,EAAErB,QAAQ,CAACsB,EAAE,CAAC;EACpD,CAAC,CAAC,OAAOH,KAAK,EAAE;IACd,IAAIA,KAAK,YAAYf,qBAAqB,EAAE;MAC1C,OAAO;QACLmB,MAAM,EAAE,SAAS;QACjBC,OAAO,EAAE,EAAE;QACXC,QAAQ,EAAEzB,QAAQ,CAACsB,EAAE;QACrBI,MAAM,EAAE;MACV,CAAC;IACH;IAEA,MAAME,OAAO,GACXT,KAAK,YAAYd,KAAK,GAClBc,KAAK,CAACS,OAAO,GACb,OAAOT,KAAK,KAAK,QAAQ,GACvBA,KAAK,GACL,+BAA+B;IAEvC,OAAO;MACLI,MAAM,EAAE,SAAS;MACjBC,OAAO,EAAE,EAAE;MACXC,QAAQ,EAAEzB,QAAQ,CAACsB,EAAE;MACrBI,MAAM,EAAE,cAAc;MACtBP,KAAK,EAAES;IACT,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/index.js

@@ -0,0 +1,5 @@
+"use strict";
+
+export { checkIntegrity } from './checkIntegrity';
+export { useDeviceIntegrity } from "./useDeviceIntegrity.js";
+//# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["checkIntegrity","useDeviceIntegrity"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,SAASA,cAAc,QAAQ,kBAAkB;AACjD,SAASC,kBAAkB,QAAQ,yBAAsB","ignoreList":[]}

package/lib/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/module/resolveStatus.js

@@ -0,0 +1,76 @@
+"use strict";
+
+const SIGNAL_CATEGORIES = new Set(['jailbreak', 'root', 'hooking', 'debugger', 'emulator', 'tamper', 'environment']);
+function coerceCategory(category) {
+  if (typeof category === 'string' && SIGNAL_CATEGORIES.has(category)) {
+    return category;
+  }
+  return 'environment';
+}
+function normalizeSignal(raw) {
+  if (raw === null || typeof raw !== 'object') {
+    return {
+      id: 'unknown_signal',
+      category: 'environment',
+      description: ''
+    };
+  }
+  const signal = raw;
+  const id = typeof signal.id === 'string' && signal.id.length > 0 ? signal.id : 'unknown_signal';
+  const description = typeof signal.description === 'string' ? signal.description : '';
+  return {
+    id,
+    category: coerceCategory(signal.category),
+    description
+  };
+}
+function malformed(platform, error) {
+  return {
+    status: 'unknown',
+    signals: [],
+    platform,
+    reason: 'native_error',
+    error
+  };
+}
+
+/**
+ * Maps a native integrity report + options to the public IntegrityResult.
+ * Compromise evidence wins over incomplete runs; incomplete/malformed never become 'clean'.
+ */
+export function resolveStatus(report, options = {}, platform) {
+  if (report === null || typeof report !== 'object' || Array.isArray(report)) {
+    return malformed(platform, 'Malformed native integrity report');
+  }
+  const nativeReport = report;
+  if (!Array.isArray(nativeReport.signals)) {
+    return malformed(platform, 'Malformed native integrity report');
+  }
+  const signals = nativeReport.signals.map(normalizeSignal);
+  const completed = nativeReport.completed === true;
+  const treatEmulatorAsCompromised = options.treatEmulatorAsCompromised === true;
+  const hasNonEmulatorSignal = signals.some(signal => signal.category !== 'emulator');
+  const hasEmulatorSignal = signals.some(signal => signal.category === 'emulator');
+  if (hasNonEmulatorSignal || hasEmulatorSignal && treatEmulatorAsCompromised) {
+    return {
+      status: 'compromised',
+      signals,
+      platform
+    };
+  }
+  if (!completed) {
+    const reason = nativeReport.reason === 'not_implemented' ? 'not_implemented' : 'incomplete';
+    return {
+      status: 'unknown',
+      signals,
+      platform,
+      reason
+    };
+  }
+  return {
+    status: 'clean',
+    signals,
+    platform
+  };
+}
+//# sourceMappingURL=resolveStatus.js.map

package/lib/module/resolveStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SIGNAL_CATEGORIES","Set","coerceCategory","category","has","normalizeSignal","raw","id","description","signal","length","malformed","platform","error","status","signals","reason","resolveStatus","report","options","Array","isArray","nativeReport","map","completed","treatEmulatorAsCompromised","hasNonEmulatorSignal","some","hasEmulatorSignal"],"sourceRoot":"../../src","sources":["resolveStatus.ts"],"mappings":";;AASA,MAAMA,iBAAsC,GAAG,IAAIC,GAAG,CAAC,CACrD,WAAW,EACX,MAAM,EACN,SAAS,EACT,UAAU,EACV,UAAU,EACV,QAAQ,EACR,aAAa,CACd,CAAC;AAEF,SAASC,cAAcA,CAACC,QAAiB,EAAkB;EACzD,IAAI,OAAOA,QAAQ,KAAK,QAAQ,IAAIH,iBAAiB,CAACI,GAAG,CAACD,QAAQ,CAAC,EAAE;IACnE,OAAOA,QAAQ;EACjB;EACA,OAAO,aAAa;AACtB;AAEA,SAASE,eAAeA,CAACC,GAAY,EAAU;EAC7C,IAAIA,GAAG,KAAK,IAAI,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3C,OAAO;MACLC,EAAE,EAAE,gBAAgB;MACpBJ,QAAQ,EAAE,aAAa;MACvBK,WAAW,EAAE;IACf,CAAC;EACH;EAEA,MAAMC,MAAM,GAAGH,GAA8B;EAC7C,MAAMC,EAAE,GACN,OAAOE,MAAM,CAACF,EAAE,KAAK,QAAQ,IAAIE,MAAM,CAACF,EAAE,CAACG,MAAM,GAAG,CAAC,GACjDD,MAAM,CAACF,EAAE,GACT,gBAAgB;EACtB,MAAMC,WAAW,GACf,OAAOC,MAAM,CAACD,WAAW,KAAK,QAAQ,GAAGC,MAAM,CAACD,WAAW,GAAG,EAAE;EAElE,OAAO;IACLD,EAAE;IACFJ,QAAQ,EAAED,cAAc,CAACO,MAAM,CAACN,QAAQ,CAAC;IACzCK;EACF,CAAC;AACH;AAEA,SAASG,SAASA,CAChBC,QAA4B,EAC5BC,KAAa,EACI;EACjB,OAAO;IACLC,MAAM,EAAE,SAAS;IACjBC,OAAO,EAAE,EAAE;IACXH,QAAQ;IACRI,MAAM,EAAE,cAAc;IACtBH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASI,aAAaA,CAC3BC,MAAe,EACfC,OAA8B,GAAG,CAAC,CAAC,EACnCP,QAA4B,EACX;EACjB,IAAIM,MAAM,KAAK,IAAI,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAIE,KAAK,CAACC,OAAO,CAACH,MAAM,CAAC,EAAE;IAC1E,OAAOP,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMU,YAAY,GAAGJ,MAAiC;EAEtD,IAAI,CAACE,KAAK,CAACC,OAAO,CAACC,YAAY,CAACP,OAAO,CAAC,EAAE;IACxC,OAAOJ,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMG,OAAO,GAAGO,YAAY,CAACP,OAAO,CAACQ,GAAG,CAAClB,eAAe,CAAC;EACzD,MAAMmB,SAAS,GAAGF,YAAY,CAACE,SAAS,KAAK,IAAI;EACjD,MAAMC,0BAA0B,GAC9BN,OAAO,CAACM,0BAA0B,KAAK,IAAI;EAE7C,MAAMC,oBAAoB,GAAGX,OAAO,CAACY,IAAI,CACtClB,MAAM,IAAKA,MAAM,CAACN,QAAQ,KAAK,UAClC,CAAC;EACD,MAAMyB,iBAAiB,GAAGb,OAAO,CAACY,IAAI,CACnClB,MAAM,IAAKA,MAAM,CAACN,QAAQ,KAAK,UAClC,CAAC;EAED,IACEuB,oBAAoB,IACnBE,iBAAiB,IAAIH,0BAA2B,EACjD;IACA,OAAO;MACLX,MAAM,EAAE,aAAa;MACrBC,OAAO;MACPH;IACF,CAAC;EACH;EAEA,IAAI,CAACY,SAAS,EAAE;IACd,MAAMR,MAAqB,GACzBM,YAAY,CAACN,MAAM,KAAK,iBAAiB,GACrC,iBAAiB,GACjB,YAAY;IAElB,OAAO;MACLF,MAAM,EAAE,SAAS;MACjBC,OAAO;MACPH,QAAQ;MACRI;IACF,CAAC;EACH;EAEA,OAAO;IACLF,MAAM,EAAE,OAAO;IACfC,OAAO;IACPH;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/types.js

@@ -0,0 +1,4 @@
+"use strict";
+
+export {};
+//# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"","ignoreList":[]}