v0.3.1 — modern Flutter third-party surface

Modern third-party coverage for Flutter apps, on top of 0.3.0's corpus-driven
detectors. Offline, no root, no INTERNET permission.

What changed in 0.3.1

Seven runtime surfaces that were invisible

Derived from the actual top-downloaded Flutter package table
(fluttertrends.dev/top/, ~230 real package names), then filtered to packages
that name a third party or a security-relevant capability. Generic plumbing
(dio, http, riverpod, go_router, connectivity_plus, package_info_plus, …) is
deliberately excluded — it identifies no vendor and would only add noise.

• Genkit (Dart AI agents) — genkit, genkit_google_genai,
  genkit_anthropic, genkit_openai, genkit_middleware. Agentic
  orchestration with tool definitions and prompt templates shipped in the app.
• Dart FFI / JNI bridge — jni, jni_flutter, objective_c, jnigen,
  dex com/github/dart_lang/jni. Native code reachable from Dart; ABI and
  memory-safety bugs live here.
• Multicast DNS / LAN discovery — multicast_dns, nsd, bonsoir,
  flutter_nsd. Finds devices on the local network and exposes peer identity.
• Crypto primitives (PointyCastle) — pointycastle, cryptography,
  cryptography_flutter, encrypt. Cryptography implemented in Dart, where
  mode and padding choices are the app's own.
• Location services — geolocator, location,
  flutter_background_geolocation, host maps.googleapis.com.
• Local notifications — flutter_local_notifications,
  awesome_notifications, dex com/dexterous/flutterlocalnotifications.
  Includes full-screen and action intents.
• Device capture and playback — image_picker, file_picker,
  video_player, just_audio, record, camera. Reads user files, camera and
  microphone.

Existing detectors widened — Firebase now also recognises firebase_ai
(Firebase AI Logic: Gemini/Imagen called from the client, the modern successor
to google_generative_ai), firebase_vertexai, firebase_crashlytics,
firebase_remote_config; Datadog recognises datadog_flutter_plugin and
datadog_flutter_plugin_flutterflow.

The third-party table now holds 145 services, matched over four independent
evidence classes: bundled files, DEX class descriptors, Dart pub packages, and
network hosts. Every hit carries which class fired, so pub:pointycastle is
distinguishable from a shared host string.

Requirements

Android 8.0+ (API 26). Sideload the signed APK; no Play Services needed.

Verification

• 239 unit tests / 34 suites / 0 failures, including the guard that no two
  services share a name (a duplicate would silently drop a detector, because
  DEX hits are keyed by service name).
• Signed with the same certificate as 0.2.0 and 0.3.0
  (7350a257df573946d83c1dfeb1124c3e35e8ca59eb175972300b2600ebbeb1bf), so it
  updates an existing install in place and keeps stored reports.
• Installed and exercised on a physical Redmi Note 9 Pro (LineageOS, API 35).

Known limits

• A matched package or host proves the string is in the APK, not that the code
  path runs or that the key is live.
• Some harvested provider hosts have no service entry yet (api.cerebras.ai,
  api.novita.ai, api.poe.com, open.bigmodel.cn, dashscope.aliyuncs.com);
  they appear in the host list but not as named providers.
• Package-name evidence depends on the pubspec or the recovered Dart strings,
  so it is strongest where NOTICES.Z or pubspec.yaml survives.
• Standing limits, unchanged: candidate routes are recovered strings rather than
  a navigation graph, libapp.so is AOT machine code (strings and symbols, not
  decompiled Dart), AABs are not supported, signature checking is structural
  rather than a full apksigner verification.