// Example: wiring the mobile RASP guard into a React Native app root.
//
// Drop this near your app entry (index.js / App.tsx). It starts a
// periodic guard that merges JS tripwires with the native probe, routes
// any non-clean verdict to your beacon, and runs a host-defined response
// when the device looks compromised.

import { NativeModules } from "react-native";
import { createMobileGuard } from "jso-protector-reactnative";

const guard = createMobileGuard({
  // The native module from templates/android + templates/ios. If you
  // haven't linked it yet, omit this — the JS tripwires still run and
  // the report records nativeProbePresent:false.
  nativeProbe: NativeModules.JsoRasp ? () => NativeModules.JsoRasp.probe() : undefined,

  // Send every non-clean report to your collector. Pair with
  // jso-beacon-slack's SIEM adapters (Splunk HEC / Elasticsearch /
  // signed webhook) — the envelope kind is "mobile-rasp".
  beaconUrl: "https://beacon.example.com/v1/jso/mobile",

  // Re-evaluate every 30s. Use 0 for a single check on start.
  intervalMs: 30000,

  // Tell the engine whether this build is a release build so the
  // __DEV__-in-release tripwire is meaningful.
  isReleaseBuild: !__DEV__,
  isDev: __DEV__,

  // Your response. The report's verdict is "clean" | "suspicious" |
  // "compromised"; signals[] explains why. Keep this conservative —
  // false positives on a rooted-but-legitimate developer device are
  // common, so prefer logging + soft-gating over a hard crash.
  onThreat(report) {
    if (report.verdict === "compromised") {
      // e.g. refuse to show the payment screen, force re-auth, or
      // sign the user out. Avoid silently corrupting state.
      console.warn("[jso-rasp] device compromised:", report.signals.map(s => s.id).join(", "));
    }
  },
});

guard.start();

export default guard;
