Welcome to BhasaGrid

Quick Start Guide

Begin securing your communications in three simple steps.

Platform Guides: Universal Core

The cross-platform React Native code is encapsulated in the bhasagrid-universal/ package, ensuring shared utilities on both native devices and desktop wrappers.

Android Stabilization & Hermes Engine

Android platforms leverage the performance-oriented Hermes JavaScript engine, which has historically lacked full WebAssembly and cryptographic primitives.

WASM Lazy Silencing Shims

To avoid crashes when importing heavy cryptographic libraries, `libsodium-wrappers` are lazily initialized. The app shims the global WebAssembly context via `firebase-polyfills.js` and suppresses console warning logs during fallback evaluation.

// Polyfill global hooks for WebAssembly on Native Hermes Engine
if (typeof WebAssembly === 'undefined') {
    global.WebAssembly = {
        instantiate: () => Promise.reject(new Error("Hermes pure-JS polyfill fallback active")),
        validate: () => false
    };
}

Web Portal & Electron Desktop Shell

The desktop wraps the Web client inside an Electron shell to allow background integration.

• System Tray Minimization: The Electron wrapper intercepts window close calls and hides the process to the system tray, keeping secure listeners active.
• Web Crypto API: Web clients use browser-native `SubtleCrypto` for hardware-accelerated AES-GCM operations.
• Metro WebSocket Auto-Resume: Integrates custom foreground listeners. On platform resume, a WebSocket ping re-pokes connections before logs drop.

Secure Communications: Calculator Camouflage

To protect users against physical search or coercive inspection, mobile clients camouflage themselves as utility games or calculators.

Sealed-Sender Messaging & Real-time Synchronization

To mask metadata, BhasaGrid utilizes Sealed-Sender envelopes when writing data to real-time streams.

{
  "lastMessageTime": "2026-05-28T16:30:00Z",
  "lastMessage": "v3.5:9e73fa8e... (encrypted text payload)",
  "messages": {
    "msg_id": {
      "timestamp": "1779952448",
      "sealedEnvelope": "{\"s\":\"sender_pub_key\",\"m\":\"v3.5:cipher_payload...\"}"
    }
  }
}

Metadata Isolation: Message text and profile status indicators are securely encrypted. Only the raw `lastSeen` timestamp is queryable, allowing fast UI rendering without compromising message confidentiality.

3-Layer Media Vault Pipeline

High-resolution 4K media undergoes a Zero-Knowledge 3-Layer pipeline prior to cloud transmission. All operations are capped at a strict 100MB limit to protect memory bounds.

Technical: 5-Level Encryption Stack

Peer capabilities are exchanged during connection. Messages are encrypted at the highest common standard both peers support.

Cross-Platform Decryption & CTR Recovery

To maintain backward compatibility with old web messages that wrote a dummy AES-GCM tag (due to library limits), native clients implement a cascading CTR Recovery solver.

Combination Cascade

If decryption fails, the recovery block attempts 3 key styles × 4 IV padding strategies = 12 combined attempts to decrypt old shims safely:

// Safe CTR Recovery cascade cascade inside decryption pipelines
const keys = [SHA256(secretKey), Buffer.from(secretKey, 'hex'), Buffer.from(secretKey, 'utf8')];
const ivPaddingOptions = [
    rawIV, 
    Buffer.concat([rawIV.slice(0, 12), Buffer.from('00000002', 'hex')]),
    Buffer.concat([rawIV.slice(0, 12), Buffer.from('00000001', 'hex')]),
    Buffer.concat([rawIV.slice(0, 12), Buffer.from('00000000', 'hex')])
];

Zero-Leak RAM Shredding & Memory Hygiene

To defend against physical RAM forensic dumps, BhasaGrid utilizes memory shredding for volatile credentials.

// MemoryHardening.secureWipe implementation details
export function secureWipe(buffer: Uint8Array): void {
    if (buffer) {
        for (let i = 0; i < buffer.length; i++) {
            buffer[i] = 0x00; // Physically overwrite memory buffers in RAM
        }
    }
}

Support & FAQ: Credential Hygiene & Auth UX

To avoid security lockouts, BhasaGrid uses a unified identity model combining password recovery with Google OAuth account linking.

• Plain-Text Queryable Invariant: To allow contact locator queries, the 4-digit social handle `userId` is queryable in plain text on Firestore, while critical validation PINs are always encrypted under `v5.5`.
• Lazy Profile Migration: The system transparently checks database profiles on login, auto-migrating and updating plain credentials to `v5.5` standards.
• Account Linking Nudges: Users authenticated with Google OAuth are optionally nudged via non-blocking modals (`AccountLinkModal.js`) to set a secondary password for secure recovery.

Frequently Asked Questions

Troubleshooting Matrix

Quick operational checks to solve synchronization or connection anomalies.

Changelog & Vision: Release Notes

Historical audit of BhasaGrid updates.

Feature Roadmap

Current development timelines for planned post-quantum features.

Standards Compliance

• WCAG 2.2 Accessibility Guidelines - Accessibility standards
• Google Material Design 3 - Responsive component specs
• Apple Human Interface Guidelines - Platform safety and secure store practices