react-native-device-integrity 0.2.1 → 0.3.0

package/README.md

@@ -79,6 +79,21 @@ To skip Info.plist URL-scheme entries (e.g. you manage them yourself):
 }
 ```
 
+To change how an unlocked bootloader is treated (see [Unlocked bootloaders](#unlocked-bootloaders)):
+
+```json
+{
+  "expo": {
+    "plugins": [
+      [
+        "react-native-device-integrity",
+        { "android": { "bootloaderUnlocked": "report" } }
+      ]
+    ]
+  }
+}
+```
+
 Then run `npx expo prebuild` or use a development build. Expo Go is not supported.
 
 ### Bare React Native
@@ -96,7 +111,50 @@ On iOS, add these schemes under `LSApplicationQueriesSchemes` in `Info.plist`:
 
 Without them, `canOpenURL` cannot query those schemes and the URL-scheme check **silently finds nothing**.
 
-Android needs no extra setup — the library manifest `<queries>` list merges automatically via the Gradle manifest merger.
+Android needs no extra setup — the library manifest `<queries>` list merges automatically via the Gradle manifest merger. To change how an unlocked bootloader is treated, add one `<meta-data>` inside `<application>` in `android/app/src/main/AndroidManifest.xml` (see [Unlocked bootloaders](#unlocked-bootloaders)):
+
+```xml
+<meta-data
+  android:name="com.deviceintegrity.bootloader_unlocked"
+  android:value="report" />
+```
+
+### Unlocked bootloaders
+
+`bootloader_unlocked` (Android) fires on any phone whose bootloader was unlocked — rooted phones, custom-ROM phones, and developers' own test phones. It's set once per app at build time:
+
+| Value | Effect |
+| --- | --- |
+| `compromised` (default) | The signal makes status `'compromised'`, like root. Matches Play Integrity, which also fails the device verdict on unlocked phones. |
+| `report` | The signal is still returned in `signals`, but never makes status `'compromised'` on its own (like `emulator`). |
+| `off` | The check doesn't run. |
+
+A missing or unrecognised value counts as `compromised`. The runtime `ignore` option still works on top (`ignore: ['bootloader_unlocked']` moves it to `ignored`).
+
+**Relaxing it doesn't hide root.** `bootloader_unlocked` and the root signals are separate checks: one asks whether the phone *can* boot unverified software, the others whether root is installed *now*. Status is `compromised` if any active signal is compromising, so a rooted phone stays `compromised` through `root_su_binary`, `root_management_apps` or `root_magisk_files` whatever this setting is. They can also fire alone — an unlocked phone running a custom ROM without root reports only `bootloader_unlocked`; a rooted phone whose boot properties are faked reports only the root signals.
+
+What you give up is the backstop when root is *hidden*: with Magisk's DenyList on, the `su` and mount checks go quiet and `bootloader_unlocked` is one of the few signals left (see [Validating on a real device](#validating-on-a-real-device)). Keep the default in production unless you have a reason not to.
+
+To relax it only for development builds of a bare app, use a Gradle placeholder:
+
+```xml
+<!-- AndroidManifest.xml -->
+<meta-data
+  android:name="com.deviceintegrity.bootloader_unlocked"
+  android:value="${deviceIntegrityBootloaderUnlocked}" />
+```
+
+```groovy
+// android/app/build.gradle
+android {
+  buildTypes {
+    debug { manifestPlaceholders += [deviceIntegrityBootloaderUnlocked: "report"] }
+    release { manifestPlaceholders += [deviceIntegrityBootloaderUnlocked: "compromised"] }
+  }
+}
+```
+
+In Expo, do the same from `app.config.js` (e.g. `bootloaderUnlocked: process.env.APP_VARIANT === 'production' ? 'compromised' : 'report'`), or at runtime with `ignore: __DEV__ ? ['bootloader_unlocked'] : []`.
 
 ## Usage
 
@@ -196,7 +254,7 @@ Tamper checks run **only** when their option is provided and non-empty (or `true
 
 `'jailbreak'` | `'root'` | `'hooking'` | `'debugger'` | `'emulator'` | `'tamper'` | `'environment'`
 
-A native category the JS layer doesn't recognise is reported as `environment`, never dropped. `tamper` is used by the opt-in tamper checks below.
+A native category the JS layer doesn't recognise is reported as `environment`, never dropped. `environment` is also the category of `bootloader_unlocked` (Android). `tamper` is used by the opt-in tamper checks below.
 
 #### `UnknownReason`
 
@@ -233,7 +291,7 @@ Behaviour:
 
 Status is resolved from the native report + options:
 
-1. Apply `ignore` — matching signals move to `ignored` and never affect status.
+1. Apply `ignore` — matching signals move to `ignored` and never affect status. Signals the app configured as report-only at build time (`bootloader_unlocked: "report"`) stay in `signals` but never affect status either.
 2. Build the compromising category set: `policy.compromisingCategories` if provided, otherwise every category except `'emulator'`. Union `'emulator'` when `treatEmulatorAsCompromised` is `true`.
 3. **Compromise evidence wins** — any non-ignored signal whose category is in that set → `'compromised'`, even if the run was incomplete.
 4. Non-compromising, non-ignored signals (e.g. emulator by default) stay in `signals` but do not change status.
@@ -308,6 +366,60 @@ it('blocks compromised devices', async () => {
 
 `setMockIntegrityResult(partial)` merges onto a default clean result (`status: 'clean'`, empty `signals` / `ignored`, `platform: 'ios'`, `durationMs: 0`). `useDeviceIntegrity` returns `{ status, signals, result, loading: false, refresh }` from the current mock result.
 
+## Validating on a real device
+
+Unit tests and the Jest mock prove your app's logic; to see the native checks fire, run them against a real, prepared device. The example app ships an **opt-in Frida Gadget build** for testing hooking detection on a stock iPhone — no jailbreak needed:
+
+```sh
+# 1. Download frida-gadget-<version>-ios-universal.dylib.xz from
+#    https://github.com/frida/frida/releases, unpack it and save it as
+#    example/frida/FridaGadget.dylib (gitignored)
+# 2. Regenerate the iOS project with the gadget wired in
+yarn example prebuild:frida
+# 3. Open example/ios/DeviceIntegrityExample.xcworkspace, pick your signing team
+#    (a free Personal Team works) and a physical iPhone, then Run
+```
+
+The [`with-frida-gadget`](example/plugins/with-frida-gadget.js) config plugin does nothing unless `FRIDA_GADGET=1` is set. When it is, it links the gadget on device builds only, embeds and signs it, writes a gadget config that starts the app normally (`on_load: resume`, `code_signing: required` — required on a stock device without a debugger), and sets the scheme to Release without LLDB. `yarn example prebuild:ios` regenerates a clean project.
+
+Observed on an iPhone XS Max (A12, iOS 18.7.10, stock): `status: compromised` with a single signal, **`hooking_libraries`**. Launched from Xcode with the debugger attached, the same build also reports `debugger_attached` and `hooking_dyld_insert` (Xcode injects its view-debugging library) — expected, not false positives.
+
+Observed on a rooted OnePlus Nord 3 (CPH2493, OxygenOS 15, unlocked bootloader, Magisk 31, no hiding): `status: compromised` with **`bootloader_unlocked`**, **`root_su_binary`**, **`root_management_apps`** and **`root_magisk_files`**, in about 150 ms. With Zygisk + DenyList hiding Magisk from the app, `root_su_binary` and `root_magisk_files` disappear (Magisk removes `su` and its mounts from the app's view), but **`bootloader_unlocked`** and **`root_management_apps`** still fire, so the status stays `compromised`. Hiding the Magisk app (randomised package name) or a `resetprop` module would remove those too — pair with server-side attestation for high-value flows.
+
+The same phone, built with each [`bootloaderUnlocked`](#unlocked-bootloaders) value:
+
+| Build setting | Root signals | Status | `bootloader_unlocked` |
+| --- | --- | --- | --- |
+| `compromised` (default) | active | `compromised` | in `signals` |
+| `compromised` (default) | ignored at runtime | `compromised` — from `bootloader_unlocked` alone | in `signals` |
+| `report` | active | `compromised` — from the root signals | in `signals` |
+| `report` | ignored at runtime | `clean` | in `signals`, not counted |
+| `off` | active | `compromised` — from the root signals | not checked |
+| default + `ignore: ['bootloader_unlocked']` | active | `compromised` — from the root signals | in `ignored` |
+
+<table>
+  <tr>
+    <th>iPhone XS Max + Frida Gadget</th>
+    <th>Same build, run from Xcode</th>
+    <th>Simulator + LLDB</th>
+    <th>Rooted OnePlus, Magisk DenyList</th>
+  </tr>
+  <tr>
+    <td><img src="docs/images/a05-frida-xs-max.jpg" width="200" alt="iPhone XS Max: COMPROMISED, hooking_libraries only"></td>
+    <td><img src="docs/images/a05-xcode-debugger-xs-max.jpg" width="200" alt="iPhone XS Max under Xcode: hooking_libraries, debugger_attached, hooking_dyld_insert"></td>
+    <td><img src="docs/images/s01-simulator-debugger.jpg" width="200" alt="iOS Simulator with LLDB attached: simulator and debugger_attached"></td>
+    <td><img src="docs/images/a02-denylist-oneplus.jpg" width="200" alt="Rooted OnePlus with DenyList: bootloader_unlocked and root_management_apps"></td>
+  </tr>
+  <tr>
+    <td>Launched from the home screen: <code>hooking_libraries</code> only.</td>
+    <td>Xcode's debugger adds <code>debugger_attached</code> and <code>hooking_dyld_insert</code>.</td>
+    <td><code>debugger_attached</code> fires; the <code>DYLD_INSERT_LIBRARIES</code> check is skipped on the Simulator.</td>
+    <td>DenyList hides <code>su</code> and the mounts; <code>bootloader_unlocked</code> and <code>root_management_apps</code> remain.</td>
+  </tr>
+</table>
+
+The project site's testing guides cover this step by step (including free vs paid Apple accounts and troubleshooting), plus rooting an Android test device and jailbreaking an iPhone (palera1n on A9–A11, Dopamine on supported A12+ builds).
+
 ## Signal reference
 
 Descriptions are generic on purpose (no matched paths or package names).
@@ -332,9 +444,10 @@ Descriptions are generic on purpose (no matched paths or package names).
 | id | category | Checks |
 | --- | --- | --- |
 | `emulator` | `emulator` | Device appears to be an emulator. |
+| `bootloader_unlocked` | `environment` | The bootloader is unlocked (verified boot state `orange`, or the flash/vbmeta lock properties say unlocked). Skipped on emulators. |
 | `root_su_binary` | `root` | A privileged elevation binary was found. |
 | `root_management_apps` | `root` | A root or privilege-management app is installed. |
-| `root_magisk_files` | `root` | Root framework artifacts were detected. |
+| `root_magisk_files` | `root` | Root framework artifacts were detected — Magisk / KernelSU / APatch mounts in the app's own mount table, or legacy paths. |
 | `root_test_keys` | `root` | Build was signed with test keys. |
 | `root_dangerous_props` | `root` | System security properties indicate an insecure build. |
 | `root_rw_system` | `root` | A system partition is mounted read-write. |
@@ -373,7 +486,9 @@ These checks run only when you pass the corresponding options. They do not run b
 
 - On the **iOS Simulator**, filesystem / URL-scheme / symlink / writable-system and `DYLD_INSERT_LIBRARIES` checks are **skipped** (they would inspect the host Mac). Skipped-by-design is not incomplete; hooking-library and debugger checks still run, plus the `simulator` signal.
 - `debugger_attached` fires whenever a debugger is attached, including during normal Xcode / Android Studio debugging.
+- Running from Xcode with the debugger also sets `DYLD_INSERT_LIBRARIES` (Xcode's view-debugging support library), so `hooking_dyld_insert` fires too. Launch from the home screen, or untick *Debug executable* in the scheme, to see the production result.
 - Android emulators still run root checks (they may report root-related signals independently of `emulator`).
+- `bootloader_unlocked` is in the `environment` category, so it is compromising by default — it fires on any developer phone whose bootloader you unlocked. Set it to `report` or `off` per app, or per build type, as described in [Unlocked bootloaders](#unlocked-bootloaders). `yellow` verified boot (locked with user keys, e.g. GrapheneOS) does not fire.
 
 ## Limitations & threat model
 
@@ -381,7 +496,7 @@ These are **client-side risk indicators**. They can be bypassed by an attacker w
 
 - Frida / objection hooking this module
 - Rootless jailbreaks with hiding tweaks
-- Magisk DenyList / Zygisk / Shamiko
+- Magisk DenyList / Zygisk / Shamiko (unmount root traces for the app; `resetprop`-based modules can also fake the verified boot properties)
 - KernelSU hiding
 
 Never rely on them alone for security decisions. For high-assurance flows, use **Apple App Attest / DeviceCheck** and the **Google Play Integrity API** server-side.

package/android/src/main/java/com/deviceintegrity/BootloaderUnlockedMode.kt

@@ -0,0 +1,58 @@
+package com.deviceintegrity
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+
+/**
+ * App-level defaults set at build time through `<meta-data>` on the app's
+ * `<application>` — written by the Expo config plugin, or by hand in bare apps:
+ *
+ *   <meta-data
+ *     android:name="com.deviceintegrity.bootloader_unlocked"
+ *     android:value="report" />
+ */
+internal enum class BootloaderUnlockedMode {
+  /** Reported and compromising (default). */
+  COMPROMISED,
+
+  /** Reported, but never changes status on its own. */
+  REPORT,
+
+  /** The check doesn't run. */
+  OFF;
+
+  companion object {
+    const val META_DATA_KEY = "com.deviceintegrity.bootloader_unlocked"
+
+    /** Missing, unreadable or unrecognised values fail closed to COMPROMISED. */
+    fun read(context: Context): BootloaderUnlockedMode {
+      val value =
+        try {
+          applicationMetaData(context)?.get(META_DATA_KEY)?.toString()?.trim()?.lowercase()
+        } catch (_: Throwable) {
+          null
+        }
+      return when (value) {
+        "report" -> REPORT
+        "off" -> OFF
+        else -> COMPROMISED
+      }
+    }
+
+    @Suppress("DEPRECATION")
+    private fun applicationMetaData(context: Context) =
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+        context.packageManager
+          .getApplicationInfo(
+            context.packageName,
+            PackageManager.ApplicationInfoFlags.of(PackageManager.GET_META_DATA.toLong()),
+          )
+          .metaData
+      } else {
+        context.packageManager
+          .getApplicationInfo(context.packageName, PackageManager.GET_META_DATA)
+          .metaData
+      }
+  }
+}

package/android/src/main/java/com/deviceintegrity/DeviceIntegrityModule.kt

@@ -108,6 +108,12 @@ class DeviceIntegrityModule(reactContext: ReactApplicationContext) :
         signals.pushMap(entry)
       }
       map.putArray("signals", signals)
+
+      if (report.reportOnly.isNotEmpty()) {
+        val reportOnly: WritableArray = Arguments.createArray()
+        report.reportOnly.forEach { reportOnly.pushString(it) }
+        map.putArray("reportOnly", reportOnly)
+      }
       return map
     }
   }

package/android/src/main/java/com/deviceintegrity/IntegrityChecks.kt

@@ -7,6 +7,7 @@ import android.os.Debug
 import java.io.BufferedReader
 import java.io.File
 import java.io.FileReader
+import java.util.concurrent.FutureTask
 import java.util.concurrent.TimeUnit
 
 /**
@@ -24,6 +25,8 @@ internal class IntegrityChecks(private val context: Context) {
     val completed: Boolean,
     val reason: String? = null,
     val signals: List<Signal>,
+    /** Signal ids the app configured as reported-only (never compromising on their own). */
+    val reportOnly: List<String> = emptyList(),
   )
 
   fun run(androidOptions: AndroidTamperOptions = AndroidTamperOptions()): Report {
@@ -46,6 +49,12 @@ internal class IntegrityChecks(private val context: Context) {
     }
 
     runCheck { checkEmulator() }
+    // Emulators boot with an unlocked (orange) state too; they're already
+    // reported as `emulator`, which isn't compromising by default.
+    val bootloaderMode = BootloaderUnlockedMode.read(context)
+    if (bootloaderMode != BootloaderUnlockedMode.OFF) {
+      runCheck { if ("emulator" in seen) null else checkBootloaderUnlocked() }
+    }
     runCheck { checkRootSuBinary() }
     runCheck { checkRootManagementApps() }
     runCheck { checkRootMagiskFiles() }
@@ -64,6 +73,8 @@ internal class IntegrityChecks(private val context: Context) {
       completed = completed,
       reason = if (completed) null else "incomplete",
       signals = signals,
+      reportOnly =
+        if (bootloaderMode == BootloaderUnlockedMode.REPORT) listOf("bootloader_unlocked") else emptyList(),
     )
   }
 
@@ -132,6 +143,35 @@ internal class IntegrityChecks(private val context: Context) {
     )
   }
 
+  // --- bootloader ---
+
+  /**
+   * Verified boot state as set by the bootloader: `green` (locked, stock keys),
+   * `yellow` (locked, user-installed keys), `orange` (unlocked). Readable by any
+   * app; a root framework can still spoof the properties for hidden apps.
+   */
+  private fun checkBootloaderUnlocked(): Signal? {
+    val verifiedBootState = readSystemProperty("ro.boot.verifiedbootstate")
+    val flashLocked = readSystemProperty("ro.boot.flash.locked")
+    val deviceState = readSystemProperty("ro.boot.vbmeta.device_state")
+
+    if (verifiedBootState == null && flashLocked == null && deviceState == null) {
+      throw IllegalStateException("getprop failed")
+    }
+
+    val unlocked =
+      verifiedBootState == "orange" || flashLocked == "0" || deviceState == "unlocked"
+    if (!unlocked) {
+      return null
+    }
+
+    return Signal(
+      id = "bootloader_unlocked",
+      category = "environment",
+      description = "The device bootloader is unlocked",
+    )
+  }
+
   // --- root ---
 
   private fun checkRootSuBinary(): Signal? {
@@ -221,6 +261,9 @@ internal class IntegrityChecks(private val context: Context) {
   }
 
   private fun checkRootMagiskFiles(): Signal? {
+    // Legacy locations (older Magisk / su-based roots). Current Magisk, KernelSU
+    // and APatch keep their files under /data/adb and a tmpfs that a normal app
+    // can't list, so on their own these miss a modern install.
     val paths =
       listOf(
         "/sbin/.magisk",
@@ -233,7 +276,7 @@ internal class IntegrityChecks(private val context: Context) {
         "/init.magisk.rc",
       )
 
-    if (!paths.any { File(it).exists() }) {
+    if (!paths.any { File(it).exists() } && !hasRootFrameworkMounts()) {
       return null
     }
 
@@ -244,6 +287,28 @@ internal class IntegrityChecks(private val context: Context) {
     )
   }
 
+  /**
+   * The mounts a root framework creates (e.g. Magisk's `magisk` tmpfs over
+   * /debug_ramdisk and the bin directories) are listed in the app's own mount
+   * table, which it can always read — unless the framework unmounts them for
+   * this app (Magisk DenyList, KernelSU umount).
+   */
+  private fun hasRootFrameworkMounts(): Boolean {
+    val sources = setOf("magisk", "ksu", "apatch")
+    return File("/proc/self/mountinfo").useLines { lines ->
+      lines.any { line ->
+        // "<id> <parent> <dev> <root> <mount point> <options> [optional…] - <fstype> <source> <super options>"
+        val separator = line.indexOf(" - ")
+        if (separator < 0) {
+          return@any false
+        }
+        val mountPoint = line.substring(0, separator).split(' ').getOrNull(4).orEmpty()
+        val source = line.substring(separator + 3).split(' ').getOrNull(1).orEmpty()
+        source.lowercase() in sources || mountPoint.contains("/.magisk")
+      }
+    }
+  }
+
   private fun checkRootTestKeys(): Signal? {
     val tags = Build.TAGS ?: return null
     if (!tags.contains("test-keys")) {
@@ -272,25 +337,41 @@ internal class IntegrityChecks(private val context: Context) {
     )
   }
 
-  private fun readSystemProperty(name: String): String? {
+  /**
+   * All system properties from one `getprop` dump, read once per run. Spawning
+   * a process costs ~100 ms from an app, so per-property calls add up quickly.
+   * Null when the dump can't be read; a property missing from it is "".
+   */
+  private val systemProperties: Map<String, String>? by lazy { readAllSystemProperties() }
+
+  private fun readSystemProperty(name: String): String? =
+    systemProperties?.let { it[name].orEmpty() }
+
+  private fun readAllSystemProperties(): Map<String, String>? {
     var process: Process? = null
     return try {
-      process = ProcessBuilder("getprop", name).redirectErrorStream(true).start()
-      val finished = process.waitFor(1, TimeUnit.SECONDS)
-      if (!finished) {
-        process.destroy()
-        process.waitFor(200, TimeUnit.MILLISECONDS)
-        if (process.isAlive) {
-          process.destroyForcibly()
+      val started = ProcessBuilder("getprop").redirectErrorStream(true).start()
+      process = started
+      // Drain stdout while waiting: the full dump can exceed the pipe buffer,
+      // and getprop would block on write until it's read.
+      val output = FutureTask { started.inputStream.bufferedReader().use { it.readText() } }
+      Thread(output, "DeviceIntegrity-getprop").apply { isDaemon = true }.start()
+      val text = output.get(1, TimeUnit.SECONDS)
+
+      // Lines look like "[ro.secure]: [1]".
+      buildMap {
+        text.lineSequence().forEach { line ->
+          val separator = line.indexOf("]: [")
+          if (line.startsWith("[") && line.endsWith("]") && separator > 0) {
+            put(line.substring(1, separator), line.substring(separator + 4, line.length - 1))
+          }
         }
-        return null
-      }
-      process.inputStream.bufferedReader().use { it.readText().trim() }
+      }.takeIf { it.isNotEmpty() } // an empty dump means we couldn't read it
     } catch (_: Throwable) {
       null
     } finally {
       try {
-        process?.destroy()
+        process?.destroyForcibly()
       } catch (_: Throwable) {
         // ignore
       }

package/jest/index.js

@@ -21,6 +21,7 @@ const SIGNAL_IDS = Object.freeze([
   'hooking_dyld_insert',
   'debugger_attached',
   'emulator',
+  'bootloader_unlocked',
   'root_su_binary',
   'root_management_apps',
   'root_magisk_files',

package/lib/module/NativeDeviceIntegrity.js.map

@@ -1 +1 @@
-{"version":3,"names":["TurboModuleRegistry","get"],"sourceRoot":"../../src","sources":["NativeDeviceIntegrity.ts"],"mappings":";;AACA,SAASA,mBAAmB,QAAQ,cAAc;AAoBlD,eAAeA,mBAAmB,CAACC,GAAG,CAAO,iBAAiB,CAAC","ignoreList":[]}
+{"version":3,"names":["TurboModuleRegistry","get"],"sourceRoot":"../../src","sources":["NativeDeviceIntegrity.ts"],"mappings":";;AACA,SAASA,mBAAmB,QAAQ,cAAc;AAsBlD,eAAeA,mBAAmB,CAACC,GAAG,CAAO,iBAAiB,CAAC","ignoreList":[]}

package/lib/module/resolveStatus.js

@@ -89,7 +89,10 @@ export function resolveStatus(report, options = {}, platform) {
   } = partitionIgnored(allSignals, options.ignore);
   const completed = nativeReport.completed === true;
   const compromising = resolveCompromisingCategories(options);
-  const hasCompromisingSignal = signals.some(signal => compromising.has(signal.category));
+  // Build-time app config (e.g. bootloader_unlocked: "report"): the signal is
+  // still returned, but never makes the status compromised on its own.
+  const reportOnly = new Set(Array.isArray(nativeReport.reportOnly) ? nativeReport.reportOnly.filter(id => typeof id === 'string') : []);
+  const hasCompromisingSignal = signals.some(signal => compromising.has(signal.category) && !reportOnly.has(signal.id));
   if (hasCompromisingSignal) {
     return {
       status: 'compromised',

package/lib/module/resolveStatus.js.map

@@ -1 +1 @@
-{"version":3,"names":["SIGNAL_CATEGORIES","Set","DEFAULT_COMPROMISING_CATEGORIES","coerceCategory","category","has","normalizeSignal","raw","id","description","signal","length","resolveCompromisingCategories","options","base","policy","compromisingCategories","set","treatEmulatorAsCompromised","add","partitionIgnored","signals","ignore","active","ignored","ignoreSet","push","malformed","platform","error","status","durationMs","reason","resolveStatus","report","Array","isArray","nativeReport","allSignals","map","completed","compromising","hasCompromisingSignal","some"],"sourceRoot":"../../src","sources":["resolveStatus.ts"],"mappings":";;AAUA,MAAMA,iBAAsC,GAAG,IAAIC,GAAG,CAAC,CACrD,WAAW,EACX,MAAM,EACN,SAAS,EACT,UAAU,EACV,UAAU,EACV,QAAQ,EACR,aAAa,CACd,CAAC;;AAEF;AACA,MAAMC,+BAA0D,GAAG,CACjE,WAAW,EACX,MAAM,EACN,SAAS,EACT,UAAU,EACV,QAAQ,EACR,aAAa,CACd;AAED,SAASC,cAAcA,CAACC,QAAiB,EAAkB;EACzD,IAAI,OAAOA,QAAQ,KAAK,QAAQ,IAAIJ,iBAAiB,CAACK,GAAG,CAACD,QAAQ,CAAC,EAAE;IACnE,OAAOA,QAAQ;EACjB;EACA,OAAO,aAAa;AACtB;AAEA,SAASE,eAAeA,CAACC,GAAY,EAAU;EAC7C,IAAIA,GAAG,KAAK,IAAI,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3C,OAAO;MACLC,EAAE,EAAE,gBAAgB;MACpBJ,QAAQ,EAAE,aAAa;MACvBK,WAAW,EAAE;IACf,CAAC;EACH;EAEA,MAAMC,MAAM,GAAGH,GAA8B;EAC7C,MAAMC,EAAE,GACN,OAAOE,MAAM,CAACF,EAAE,KAAK,QAAQ,IAAIE,MAAM,CAACF,EAAE,CAACG,MAAM,GAAG,CAAC,GACjDD,MAAM,CAACF,EAAE,GACT,gBAAgB;EACtB,MAAMC,WAAW,GACf,OAAOC,MAAM,CAACD,WAAW,KAAK,QAAQ,GAAGC,MAAM,CAACD,WAAW,GAAG,EAAE;EAElE,OAAO;IACLD,EAAE;IACFJ,QAAQ,EAAED,cAAc,CAACO,MAAM,CAACN,QAAQ,CAAC;IACzCK;EACF,CAAC;AACH;AAEA,SAASG,6BAA6BA,CACpCC,OAA8B,EACD;EAC7B,MAAMC,IAAI,GACRD,OAAO,CAACE,MAAM,EAAEC,sBAAsB,IAAI,IAAI,GAC1CH,OAAO,CAACE,MAAM,CAACC,sBAAsB,GACrCd,+BAA+B;EAErC,MAAMe,GAAG,GAAG,IAAIhB,GAAG,CAAiBa,IAAI,CAAC;EAEzC,IAAID,OAAO,CAACK,0BAA0B,KAAK,IAAI,EAAE;IAC/CD,GAAG,CAACE,GAAG,CAAC,UAAU,CAAC;EACrB;EAEA,OAAOF,GAAG;AACZ;AAEA,SAASG,gBAAgBA,CACvBC,OAAiB,EACjBC,MAA8B,EACW;EACzC,IAAIA,MAAM,IAAI,IAAI,IAAIA,MAAM,CAACX,MAAM,KAAK,CAAC,EAAE;IACzC,OAAO;MAAEY,MAAM,EAAEF,OAAO;MAAEG,OAAO,EAAE;IAAG,CAAC;EACzC;EAEA,MAAMC,SAAS,GAAG,IAAIxB,GAAG,CAASqB,MAAM,CAAC;EACzC,MAAMC,MAAgB,GAAG,EAAE;EAC3B,MAAMC,OAAiB,GAAG,EAAE;EAE5B,KAAK,MAAMd,MAAM,IAAIW,OAAO,EAAE;IAC5B,IAAII,SAAS,CAACpB,GAAG,CAACK,MAAM,CAACF,EAAE,CAAC,EAAE;MAC5BgB,OAAO,CAACE,IAAI,CAAChB,MAAM,CAAC;IACtB,CAAC,MAAM;MACLa,MAAM,CAACG,IAAI,CAAChB,MAAM,CAAC;IACrB;EACF;EAEA,OAAO;IAAEa,MAAM;IAAEC;EAAQ,CAAC;AAC5B;AAEA,SAASG,SAASA,CAChBC,QAA4B,EAC5BC,KAAa,EACI;EACjB,OAAO;IACLC,MAAM,EAAE,SAAS;IACjBT,OAAO,EAAE,EAAE;IACXG,OAAO,EAAE,EAAE;IACXO,UAAU,EAAE,CAAC;IACbH,QAAQ;IACRI,MAAM,EAAE,cAAc;IACtBH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASI,aAAaA,CAC3BC,MAAe,EACfrB,OAA8B,GAAG,CAAC,CAAC,EACnCe,QAA4B,EACX;EACjB,IAAIM,MAAM,KAAK,IAAI,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAIC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;IAC1E,OAAOP,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMS,YAAY,GAAGH,MAAiC;EAEtD,IAAI,CAACC,KAAK,CAACC,OAAO,CAACC,YAAY,CAAChB,OAAO,CAAC,EAAE;IACxC,OAAOM,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMU,UAAU,GAAGD,YAAY,CAAChB,OAAO,CAACkB,GAAG,CAACjC,eAAe,CAAC;EAC5D,MAAM;IAAEiB,MAAM,EAAEF,OAAO;IAAEG;EAAQ,CAAC,GAAGJ,gBAAgB,CACnDkB,UAAU,EACVzB,OAAO,CAACS,MACV,CAAC;EACD,MAAMkB,SAAS,GAAGH,YAAY,CAACG,SAAS,KAAK,IAAI;EACjD,MAAMC,YAAY,GAAG7B,6BAA6B,CAACC,OAAO,CAAC;EAE3D,MAAM6B,qBAAqB,GAAGrB,OAAO,CAACsB,IAAI,CAAEjC,MAAM,IAChD+B,YAAY,CAACpC,GAAG,CAACK,MAAM,CAACN,QAAQ,CAClC,CAAC;EAED,IAAIsC,qBAAqB,EAAE;IACzB,OAAO;MACLZ,MAAM,EAAE,aAAa;MACrBT,OAAO;MACPG,OAAO;MACPO,UAAU,EAAE,CAAC;MACbH;IACF,CAAC;EACH;EAEA,IAAI,CAACY,SAAS,EAAE;IACd,MAAMR,MAAqB,GACzBK,YAAY,CAACL,MAAM,KAAK,iBAAiB,GACrC,iBAAiB,GACjB,YAAY;IAElB,OAAO;MACLF,MAAM,EAAE,SAAS;MACjBT,OAAO;MACPG,OAAO;MACPO,UAAU,EAAE,CAAC;MACbH,QAAQ;MACRI;IACF,CAAC;EACH;EAEA,OAAO;IACLF,MAAM,EAAE,OAAO;IACfT,OAAO;IACPG,OAAO;IACPO,UAAU,EAAE,CAAC;IACbH;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["SIGNAL_CATEGORIES","Set","DEFAULT_COMPROMISING_CATEGORIES","coerceCategory","category","has","normalizeSignal","raw","id","description","signal","length","resolveCompromisingCategories","options","base","policy","compromisingCategories","set","treatEmulatorAsCompromised","add","partitionIgnored","signals","ignore","active","ignored","ignoreSet","push","malformed","platform","error","status","durationMs","reason","resolveStatus","report","Array","isArray","nativeReport","allSignals","map","completed","compromising","reportOnly","filter","hasCompromisingSignal","some"],"sourceRoot":"../../src","sources":["resolveStatus.ts"],"mappings":";;AAUA,MAAMA,iBAAsC,GAAG,IAAIC,GAAG,CAAC,CACrD,WAAW,EACX,MAAM,EACN,SAAS,EACT,UAAU,EACV,UAAU,EACV,QAAQ,EACR,aAAa,CACd,CAAC;;AAEF;AACA,MAAMC,+BAA0D,GAAG,CACjE,WAAW,EACX,MAAM,EACN,SAAS,EACT,UAAU,EACV,QAAQ,EACR,aAAa,CACd;AAED,SAASC,cAAcA,CAACC,QAAiB,EAAkB;EACzD,IAAI,OAAOA,QAAQ,KAAK,QAAQ,IAAIJ,iBAAiB,CAACK,GAAG,CAACD,QAAQ,CAAC,EAAE;IACnE,OAAOA,QAAQ;EACjB;EACA,OAAO,aAAa;AACtB;AAEA,SAASE,eAAeA,CAACC,GAAY,EAAU;EAC7C,IAAIA,GAAG,KAAK,IAAI,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3C,OAAO;MACLC,EAAE,EAAE,gBAAgB;MACpBJ,QAAQ,EAAE,aAAa;MACvBK,WAAW,EAAE;IACf,CAAC;EACH;EAEA,MAAMC,MAAM,GAAGH,GAA8B;EAC7C,MAAMC,EAAE,GACN,OAAOE,MAAM,CAACF,EAAE,KAAK,QAAQ,IAAIE,MAAM,CAACF,EAAE,CAACG,MAAM,GAAG,CAAC,GACjDD,MAAM,CAACF,EAAE,GACT,gBAAgB;EACtB,MAAMC,WAAW,GACf,OAAOC,MAAM,CAACD,WAAW,KAAK,QAAQ,GAAGC,MAAM,CAACD,WAAW,GAAG,EAAE;EAElE,OAAO;IACLD,EAAE;IACFJ,QAAQ,EAAED,cAAc,CAACO,MAAM,CAACN,QAAQ,CAAC;IACzCK;EACF,CAAC;AACH;AAEA,SAASG,6BAA6BA,CACpCC,OAA8B,EACD;EAC7B,MAAMC,IAAI,GACRD,OAAO,CAACE,MAAM,EAAEC,sBAAsB,IAAI,IAAI,GAC1CH,OAAO,CAACE,MAAM,CAACC,sBAAsB,GACrCd,+BAA+B;EAErC,MAAMe,GAAG,GAAG,IAAIhB,GAAG,CAAiBa,IAAI,CAAC;EAEzC,IAAID,OAAO,CAACK,0BAA0B,KAAK,IAAI,EAAE;IAC/CD,GAAG,CAACE,GAAG,CAAC,UAAU,CAAC;EACrB;EAEA,OAAOF,GAAG;AACZ;AAEA,SAASG,gBAAgBA,CACvBC,OAAiB,EACjBC,MAA8B,EACW;EACzC,IAAIA,MAAM,IAAI,IAAI,IAAIA,MAAM,CAACX,MAAM,KAAK,CAAC,EAAE;IACzC,OAAO;MAAEY,MAAM,EAAEF,OAAO;MAAEG,OAAO,EAAE;IAAG,CAAC;EACzC;EAEA,MAAMC,SAAS,GAAG,IAAIxB,GAAG,CAASqB,MAAM,CAAC;EACzC,MAAMC,MAAgB,GAAG,EAAE;EAC3B,MAAMC,OAAiB,GAAG,EAAE;EAE5B,KAAK,MAAMd,MAAM,IAAIW,OAAO,EAAE;IAC5B,IAAII,SAAS,CAACpB,GAAG,CAACK,MAAM,CAACF,EAAE,CAAC,EAAE;MAC5BgB,OAAO,CAACE,IAAI,CAAChB,MAAM,CAAC;IACtB,CAAC,MAAM;MACLa,MAAM,CAACG,IAAI,CAAChB,MAAM,CAAC;IACrB;EACF;EAEA,OAAO;IAAEa,MAAM;IAAEC;EAAQ,CAAC;AAC5B;AAEA,SAASG,SAASA,CAChBC,QAA4B,EAC5BC,KAAa,EACI;EACjB,OAAO;IACLC,MAAM,EAAE,SAAS;IACjBT,OAAO,EAAE,EAAE;IACXG,OAAO,EAAE,EAAE;IACXO,UAAU,EAAE,CAAC;IACbH,QAAQ;IACRI,MAAM,EAAE,cAAc;IACtBH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASI,aAAaA,CAC3BC,MAAe,EACfrB,OAA8B,GAAG,CAAC,CAAC,EACnCe,QAA4B,EACX;EACjB,IAAIM,MAAM,KAAK,IAAI,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAIC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;IAC1E,OAAOP,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMS,YAAY,GAAGH,MAAiC;EAEtD,IAAI,CAACC,KAAK,CAACC,OAAO,CAACC,YAAY,CAAChB,OAAO,CAAC,EAAE;IACxC,OAAOM,SAAS,CAACC,QAAQ,EAAE,mCAAmC,CAAC;EACjE;EAEA,MAAMU,UAAU,GAAGD,YAAY,CAAChB,OAAO,CAACkB,GAAG,CAACjC,eAAe,CAAC;EAC5D,MAAM;IAAEiB,MAAM,EAAEF,OAAO;IAAEG;EAAQ,CAAC,GAAGJ,gBAAgB,CACnDkB,UAAU,EACVzB,OAAO,CAACS,MACV,CAAC;EACD,MAAMkB,SAAS,GAAGH,YAAY,CAACG,SAAS,KAAK,IAAI;EACjD,MAAMC,YAAY,GAAG7B,6BAA6B,CAACC,OAAO,CAAC;EAC3D;EACA;EACA,MAAM6B,UAAU,GAAG,IAAIzC,GAAG,CACxBkC,KAAK,CAACC,OAAO,CAACC,YAAY,CAACK,UAAU,CAAC,GAClCL,YAAY,CAACK,UAAU,CAACC,MAAM,CAC3BnC,EAAE,IAAmB,OAAOA,EAAE,KAAK,QACtC,CAAC,GACD,EACN,CAAC;EAED,MAAMoC,qBAAqB,GAAGvB,OAAO,CAACwB,IAAI,CACvCnC,MAAM,IAAK+B,YAAY,CAACpC,GAAG,CAACK,MAAM,CAACN,QAAQ,CAAC,IAAI,CAACsC,UAAU,CAACrC,GAAG,CAACK,MAAM,CAACF,EAAE,CAC5E,CAAC;EAED,IAAIoC,qBAAqB,EAAE;IACzB,OAAO;MACLd,MAAM,EAAE,aAAa;MACrBT,OAAO;MACPG,OAAO;MACPO,UAAU,EAAE,CAAC;MACbH;IACF,CAAC;EACH;EAEA,IAAI,CAACY,SAAS,EAAE;IACd,MAAMR,MAAqB,GACzBK,YAAY,CAACL,MAAM,KAAK,iBAAiB,GACrC,iBAAiB,GACjB,YAAY;IAElB,OAAO;MACLF,MAAM,EAAE,SAAS;MACjBT,OAAO;MACPG,OAAO;MACPO,UAAU,EAAE,CAAC;MACbH,QAAQ;MACRI;IACF,CAAC;EACH;EAEA,OAAO;IACLF,MAAM,EAAE,OAAO;IACfT,OAAO;IACPG,OAAO;IACPO,UAAU,EAAE,CAAC;IACbH;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/types.js

@@ -3,5 +3,5 @@
 /**
  * Stable public signal ids. Unknown future ids remain accepted on `Signal.id`.
  */
-export const SIGNAL_IDS = ['simulator', 'jailbreak_files', 'jailbreak_url_schemes', 'jailbreak_symlinks', 'jailbreak_writable_system', 'hooking_libraries', 'hooking_dyld_insert', 'debugger_attached', 'emulator', 'root_su_binary', 'root_management_apps', 'root_magisk_files', 'root_test_keys', 'root_dangerous_props', 'root_rw_system', 'hooking_frida', 'hooking_xposed', 'tamper_signature_mismatch', 'tamper_untrusted_installer', 'tamper_binary_decrypted', 'tamper_team_id_mismatch'];
+export const SIGNAL_IDS = ['simulator', 'jailbreak_files', 'jailbreak_url_schemes', 'jailbreak_symlinks', 'jailbreak_writable_system', 'hooking_libraries', 'hooking_dyld_insert', 'debugger_attached', 'emulator', 'bootloader_unlocked', 'root_su_binary', 'root_management_apps', 'root_magisk_files', 'root_test_keys', 'root_dangerous_props', 'root_rw_system', 'hooking_frida', 'hooking_xposed', 'tamper_signature_mismatch', 'tamper_untrusted_installer', 'tamper_binary_decrypted', 'tamper_team_id_mismatch'];
 //# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["SIGNAL_IDS"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":";;AAaA;AACA;AACA;AACA,OAAO,MAAMA,UAAU,GAAG,CACxB,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,CACjB","ignoreList":[]}
+{"version":3,"names":["SIGNAL_IDS"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":";;AAaA;AACA;AACA;AACA,OAAO,MAAMA,UAAU,GAAG,CACxB,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,CACjB","ignoreList":[]}

package/lib/typescript/src/NativeDeviceIntegrity.d.ts

@@ -8,6 +8,8 @@ export type NativeIntegrityReport = {
     completed: boolean;
     reason?: string;
     signals: NativeSignal[];
+    /** Signal ids the app configured at build time as reported-only (Android). */
+    reportOnly?: string[];
 };
 export interface Spec extends TurboModule {
     checkIntegrity(options: Object): Promise<NativeIntegrityReport>;

package/lib/typescript/src/NativeDeviceIntegrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NativeDeviceIntegrity.d.ts","sourceRoot":"","sources":["../../../src/NativeDeviceIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,WAAW,IAAK,SAAQ,WAAW;IAGvC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACjE;;AAED,wBAAgE"}
+{"version":3,"file":"NativeDeviceIntegrity.d.ts","sourceRoot":"","sources":["../../../src/NativeDeviceIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,IAAK,SAAQ,WAAW;IAGvC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACjE;;AAED,wBAAgE"}

package/lib/typescript/src/resolveStatus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveStatus.d.ts","sourceRoot":"","sources":["../../../src/resolveStatus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EACV,qBAAqB,EACrB,eAAe,EAKhB,MAAM,YAAS,CAAC;AA4GjB;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,YAAK,EACnC,QAAQ,EAAE,OAAO,QAAQ,CAAC,EAAE,GAC3B,eAAe,CAwDjB"}
+{"version":3,"file":"resolveStatus.d.ts","sourceRoot":"","sources":["../../../src/resolveStatus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EACV,qBAAqB,EACrB,eAAe,EAKhB,MAAM,YAAS,CAAC;AA4GjB;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,YAAK,EACnC,QAAQ,EAAE,OAAO,QAAQ,CAAC,EAAE,GAC3B,eAAe,CAiEjB"}

package/lib/typescript/src/types.d.ts

@@ -4,7 +4,7 @@ export type SignalCategory = 'jailbreak' | 'root' | 'hooking' | 'debugger' | 'em
 /**
  * Stable public signal ids. Unknown future ids remain accepted on `Signal.id`.
  */
-export declare const SIGNAL_IDS: readonly ["simulator", "jailbreak_files", "jailbreak_url_schemes", "jailbreak_symlinks", "jailbreak_writable_system", "hooking_libraries", "hooking_dyld_insert", "debugger_attached", "emulator", "root_su_binary", "root_management_apps", "root_magisk_files", "root_test_keys", "root_dangerous_props", "root_rw_system", "hooking_frida", "hooking_xposed", "tamper_signature_mismatch", "tamper_untrusted_installer", "tamper_binary_decrypted", "tamper_team_id_mismatch"];
+export declare const SIGNAL_IDS: readonly ["simulator", "jailbreak_files", "jailbreak_url_schemes", "jailbreak_symlinks", "jailbreak_writable_system", "hooking_libraries", "hooking_dyld_insert", "debugger_attached", "emulator", "bootloader_unlocked", "root_su_binary", "root_management_apps", "root_magisk_files", "root_test_keys", "root_dangerous_props", "root_rw_system", "hooking_frida", "hooking_xposed", "tamper_signature_mismatch", "tamper_untrusted_installer", "tamper_binary_decrypted", "tamper_team_id_mismatch"];
 export type SignalId = (typeof SIGNAL_IDS)[number];
 export interface Signal {
     /** Known ids autocomplete; unknown future ids are still accepted. */

package/lib/typescript/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,MAAM,GACN,SAAS,GACT,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,CAAC;AAElB;;GAEG;AACH,eAAO,MAAM,UAAU,mdAsBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,MAAM,WAAW,MAAM;IACrB,qEAAqE;IACrE,EAAE,EAAE,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,0FAA0F;IAC1F,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uFAAuF;IACvF,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,qEAAqE;IACrE,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,iEAAiE;IACjE,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,MAAM,GACN,SAAS,GACT,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,CAAC;AAElB;;GAEG;AACH,eAAO,MAAM,UAAU,0eAuBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,MAAM,WAAW,MAAM;IACrB,qEAAqE;IACrE,EAAE,EAAE,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,0FAA0F;IAC1F,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uFAAuF;IACvF,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,qEAAqE;IACrE,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,iEAAiE;IACjE,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-device-integrity",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Jailbreak, root, hooking, debugger and emulator detection for React Native and Expo",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

package/plugin/build/index.d.ts

@@ -1,10 +1,21 @@
-import { type ConfigPlugin, type InfoPlist } from 'expo/config-plugins';
+import { type AndroidManifest, type ConfigPlugin, type InfoPlist } from 'expo/config-plugins';
 export declare const JAILBREAK_URL_SCHEMES: readonly ["cydia", "sileo", "zbra", "filza", "undecimus", "activator"];
+/** How `bootloader_unlocked` affects status. Default `'compromised'`. */
+export type BootloaderUnlockedMode = 'compromised' | 'report' | 'off';
+export declare const BOOTLOADER_UNLOCKED_META_DATA = "com.deviceintegrity.bootloader_unlocked";
 export type DeviceIntegrityPluginProps = {
     ios?: {
         /** When false, skip Info.plist changes. Default true. */
         jailbreakUrlSchemes?: boolean;
     };
+    android?: {
+        /**
+         * `'compromised'` (default): an unlocked bootloader makes status compromised.
+         * `'report'`: the signal is returned but never compromising on its own.
+         * `'off'`: the check doesn't run.
+         */
+        bootloaderUnlocked?: BootloaderUnlockedMode;
+    };
 };
 /**
  * Merge jailbreak URL schemes into LSApplicationQueriesSchemes.
@@ -14,6 +25,11 @@ export type DeviceIntegrityPluginProps = {
  * automatically via the Gradle manifest merger.
  */
 export declare function addJailbreakQueriesSchemes(infoPlist: InfoPlist): InfoPlist;
+/**
+ * Write (or, for the default `'compromised'`, remove) the `<meta-data>` the
+ * native module reads on the main `<application>`.
+ */
+export declare function setBootloaderUnlockedMetaData(manifest: AndroidManifest, mode: BootloaderUnlockedMode | undefined): AndroidManifest;
 export declare const withDeviceIntegrity: ConfigPlugin<DeviceIntegrityPluginProps | void>;
 declare const _default: ConfigPlugin<void | DeviceIntegrityPluginProps>;
 export default _default;

package/plugin/build/index.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withDeviceIntegrity = exports.JAILBREAK_URL_SCHEMES = void 0;
+exports.withDeviceIntegrity = exports.BOOTLOADER_UNLOCKED_META_DATA = exports.JAILBREAK_URL_SCHEMES = void 0;
 exports.addJailbreakQueriesSchemes = addJailbreakQueriesSchemes;
+exports.setBootloaderUnlockedMetaData = setBootloaderUnlockedMetaData;
 const config_plugins_1 = require("expo/config-plugins");
 // keep in sync with ios/DIIntegrityChecks.m hasJailbreakURLSchemes
 exports.JAILBREAK_URL_SCHEMES = [
@@ -12,6 +13,13 @@ exports.JAILBREAK_URL_SCHEMES = [
     'undecimus',
     'activator',
 ];
+// keep in sync with android/.../BootloaderUnlockedMode.kt
+exports.BOOTLOADER_UNLOCKED_META_DATA = 'com.deviceintegrity.bootloader_unlocked';
+const BOOTLOADER_UNLOCKED_MODES = [
+    'compromised',
+    'report',
+    'off',
+];
 /**
  * Merge jailbreak URL schemes into LSApplicationQueriesSchemes.
  * Keeps existing entries/order, appends missing ones, never removes.
@@ -34,15 +42,48 @@ function addJailbreakQueriesSchemes(infoPlist) {
         LSApplicationQueriesSchemes: current,
     };
 }
+/**
+ * Write (or, for the default `'compromised'`, remove) the `<meta-data>` the
+ * native module reads on the main `<application>`.
+ */
+function setBootloaderUnlockedMetaData(manifest, mode) {
+    var _a, _b;
+    if (mode != null && !BOOTLOADER_UNLOCKED_MODES.includes(mode)) {
+        throw new Error(`react-native-device-integrity: android.bootloaderUnlocked must be one of ${BOOTLOADER_UNLOCKED_MODES.map((value) => `"${value}"`).join(', ')} (got ${JSON.stringify(mode)})`);
+    }
+    const application = (_a = manifest.manifest.application) === null || _a === void 0 ? void 0 : _a[0];
+    if (application == null) {
+        return manifest;
+    }
+    const others = ((_b = application['meta-data']) !== null && _b !== void 0 ? _b : []).filter((item) => item.$['android:name'] !== exports.BOOTLOADER_UNLOCKED_META_DATA);
+    application['meta-data'] =
+        mode == null || mode === 'compromised'
+            ? others
+            : [
+                ...others,
+                {
+                    $: {
+                        'android:name': exports.BOOTLOADER_UNLOCKED_META_DATA,
+                        'android:value': mode,
+                    },
+                },
+            ];
+    return manifest;
+}
 const withDeviceIntegrity = (config, props) => {
     var _a;
-    if (((_a = props === null || props === void 0 ? void 0 : props.ios) === null || _a === void 0 ? void 0 : _a.jailbreakUrlSchemes) === false) {
-        return config;
-    }
-    return (0, config_plugins_1.withInfoPlist)(config, (modConfig) => {
-        modConfig.modResults = addJailbreakQueriesSchemes(modConfig.modResults);
+    let result = (0, config_plugins_1.withAndroidManifest)(config, (modConfig) => {
+        var _a;
+        modConfig.modResults = setBootloaderUnlockedMetaData(modConfig.modResults, (_a = props === null || props === void 0 ? void 0 : props.android) === null || _a === void 0 ? void 0 : _a.bootloaderUnlocked);
         return modConfig;
     });
+    if (((_a = props === null || props === void 0 ? void 0 : props.ios) === null || _a === void 0 ? void 0 : _a.jailbreakUrlSchemes) !== false) {
+        result = (0, config_plugins_1.withInfoPlist)(result, (modConfig) => {
+            modConfig.modResults = addJailbreakQueriesSchemes(modConfig.modResults);
+            return modConfig;
+        });
+    }
+    return result;
 };
 exports.withDeviceIntegrity = withDeviceIntegrity;
 const pkg = require('../../package.json');

package/src/NativeDeviceIntegrity.ts

@@ -11,6 +11,8 @@ export type NativeIntegrityReport = {
   completed: boolean;
   reason?: string;
   signals: NativeSignal[];
+  /** Signal ids the app configured at build time as reported-only (Android). */
+  reportOnly?: string[];
 };
 
 export interface Spec extends TurboModule {

package/src/resolveStatus.ts

@@ -141,9 +141,18 @@ export function resolveStatus(
   );
   const completed = nativeReport.completed === true;
   const compromising = resolveCompromisingCategories(options);
+  // Build-time app config (e.g. bootloader_unlocked: "report"): the signal is
+  // still returned, but never makes the status compromised on its own.
+  const reportOnly = new Set(
+    Array.isArray(nativeReport.reportOnly)
+      ? nativeReport.reportOnly.filter(
+          (id): id is string => typeof id === 'string'
+        )
+      : []
+  );
 
-  const hasCompromisingSignal = signals.some((signal) =>
-    compromising.has(signal.category)
+  const hasCompromisingSignal = signals.some(
+    (signal) => compromising.has(signal.category) && !reportOnly.has(signal.id)
   );
 
   if (hasCompromisingSignal) {

package/src/types.ts

@@ -24,6 +24,7 @@ export const SIGNAL_IDS = [
   'hooking_dyld_insert',
   'debugger_attached',
   'emulator',
+  'bootloader_unlocked',
   'root_su_binary',
   'root_management_apps',
   'root_magisk_files',