React Native SDK: protocol conformance, prebuilt walls, SHA-512 without WebCrypto

Author: meliharik

.github/workflows/ci.yaml

@@ -0,0 +1,20 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm install
+      - run: npm run typecheck
+      # The golden vectors are the contract between every Ripstop SDK. Red here
+      # means this SDK disagrees with the protocol, not the other way round.
+      - run: npm test
+      - run: npm run build

.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+*.log
+.DS_Store

CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 0.1.0
+
+First release.
+
+- Force update, soft update, kill switch and maintenance mode, decided by the
+  protocol's evaluation order and verified against the golden vectors.
+- Remote config values in the same signed payload — no extra request.
+- Ed25519 verification of the exact response bytes, with SHA-512 wired for
+  runtimes without `crypto.subtle` — which is all of React Native.
+- Signed cache, re-verified on read. AsyncStorage adapter, no dependency on it.
+- `RipstopProvider` with prebuilt walls, or `useRipstop()` and draw your own.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ripstop
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,86 @@
+# @ripstop/react-native
+
+**Force update, kill switch, maintenance mode and remote config for React Native.**
+Decided at the edge, verified on device.
+
+[![npm](https://img.shields.io/npm/v/@ripstop/react-native.svg)](https://www.npmjs.com/package/@ripstop/react-native)
+[![CI](https://github.com/ripstop-dev/ripstop-react-native/actions/workflows/ci.yaml/badge.svg)](https://github.com/ripstop-dev/ripstop-react-native/actions/workflows/ci.yaml)
+[![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+## Install
+
+```bash
+npm install @ripstop/react-native
+```
+
+No native modules, no pod install, no config plugin. It is JavaScript.
+
+## Quickstart
+
+```tsx
+import { RipstopProvider } from '@ripstop/react-native';
+import AsyncStorage from '@react-native-async-storage/async-storage';
+import { asyncStorageAdapter } from '@ripstop/react-native';
+
+export default function App() {
+  return (
+    <RipstopProvider
+      apiKey="rs_pub_your_key"
+      appVersion={DeviceInfo.getVersion()}
+      storage={asyncStorageAdapter(AsyncStorage)}
+    >
+      <MyApp />
+    </RipstopProvider>
+  );
+}
+```
+
+That's the whole integration. The provider renders your app until a decision
+says otherwise, then shows the right wall.
+
+## Or draw your own
+
+```tsx
+const { decision, values, snooze, loading } = useRipstop();
+
+if (decision.type === 'force') return <MyUpdateScreen {...decision} />;
+```
+
+Pass `walls={false}` to the provider and nothing is rendered for you.
+
+## Storage
+
+The cache is in-memory unless you give it somewhere to live. AsyncStorage is a
+separate package and the SDK will not add it to your app on your behalf — pass
+your existing instance through `asyncStorageAdapter` and the cache survives
+restarts.
+
+## What it does when things break
+
+| Situation | What your app does |
+| --- | --- |
+| No network | Uses the last **signed** payload |
+| No network, no cache | `none` — your app runs, unrestricted |
+| Server returns 500, or times out | Cache, then normal |
+| Signature doesn't verify | Discarded. A forged payload can never kill your app |
+| Cache tampered with | Re-verified on read, so it grants nothing |
+| Kill switch on, then network lost | The kill **stays**, until a fresh signed payload clears it |
+
+## About `crypto.subtle`
+
+React Native doesn't have it. `@noble/ed25519` backs its SHA-512 with WebCrypto
+by default, so a naive integration verifies fine in every test and throws on the
+first real device. This package wires SHA-512 explicitly from `@noble/hashes`,
+and has a test that deletes `crypto.subtle` before importing anything — because
+a test that runs on Node's fallback would pass whether or not the fix was there.
+
+## Conformance
+
+Every Ripstop SDK runs the same `vectors.json` — version ordering, evaluation
+order, snooze accounting, the fail-open state machine. `npm test` runs it here.
+
+Full docs: **[ripstop.dev/docs/react-native](https://ripstop.dev/docs/react-native)**
+
+## License
+
+MIT

eslint.config.js

@@ -0,0 +1,9 @@
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  { ignores: ['dist/**', 'node_modules/**'] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  { rules: { '@typescript-eslint/no-explicit-any': 'error' } },
+);