# Changelog

## Unreleased

- Added a customer-use licence and versioned direct-download distribution.
- Clarified that the package is not published in the npm registry.

## 0.2.0 - 2026-07-13

- Replaced illustrative Android/iOS placeholder probes with self-contained native checks and signature pinning.
- Added Android ReactPackage registration and lock/callback compromise responses.
- Fixed mobile beacon delivery issuing duplicate POST requests.

## 0.1.0 — 2026-06-02

Initial release. Mobile RASP runtime for React Native / Cordova / Ionic
apps protected with JavaScript Obfuscator. Closes the mobile/hybrid
reverse-engineering gap (Guardsquare DexGuard/iXGuard, Licel
DexProtector, JSDefender RN Metro plugin) surfaced by the deep-research
competitive sweep.

### Added

- **Pure-data RASP engine** (`rasp.js`) — `evaluate(env)` merges two
  signal sources into one scored threat report:
  - JS-observable tripwires: Frida/Gum globals, `Function.prototype.toString`
    tamper, instrumentation-namespace globals (`__frida_*`, `_gum*`,
    `__xposed*`, …), `__DEV__`-in-release, and an injectable-clock timing
    anomaly probe.
  - Native-probe merge: root, jailbreak, debuggable, emulator, hooks,
    signature tampering, unofficial store, and named tools (Magisk,
    unc0ver, checkra1n, Dopamine, Frida, Xposed, Substrate, …).
  - Verdict thresholds: `clean` < 30 ≤ `suspicious` < 60 ≤ `compromised`.
    Documented, tunable `SIGNAL_WEIGHTS`.
- **Guard orchestration** (`index.js` `createMobileGuard`) — periodic or
  one-shot evaluation, async native-probe support with throw capture,
  verdict-change-aware threat hook, bounded history, and a beacon POST
  on any non-clean verdict using the `kind: "mobile-rasp"` envelope (same
  shape the browser modules use, so `jso-beacon-slack` SIEM adapters
  forward it unchanged). Every external dependency (`fetch`,
  `setInterval`, clock, global) is injectable for testing.
- **Native-probe contract** (`native-probe.js`) — documented result
  schema + a safe `noopProbe` default so the engine has a stable contract
  whether or not a native module is wired.
- **Native bridge stub templates** — `templates/android/JsoRaspModule.kt`
  and `templates/ios/JsoRasp.swift`, React Native native modules that wrap
  freeRASP (or any backend) and return the schema-shaped result.
- **Build re-export** — `withMetro()` re-exports `jso-protector`'s Metro
  serializer so RN apps have a single entry point.
- 25 Node tests (15 engine + 10 guard). No device required.

### Notes

- JS-only detection is defence-in-depth, not a guarantee; the strong
  assurance is in the native probe. Documented prominently in the README.
- `jso-protector` and `react-native` are optional peer dependencies; the
  pure engine has zero runtime deps.
