		'use strict';

		var encoding = require('@turnkey/encoding');
		var p256 = require('@noble/curves/p256');
		var sha2 = require('@noble/hashes/sha2');
		var CBOR = require('cbor-js');
		var x509 = require('@peculiar/x509');
		var constants = require('./constants.js');

		function _interopNamespaceDefault(e) {
		var n = Object.create(null);
		if (e) {
		Object.keys(e).forEach(function (k) {
		if (k !== 'default') {
		var d = Object.getOwnPropertyDescriptor(e, k);
		Object.defineProperty(n, k, d.get ? d : {
		enumerable: true,
		get: function () { return e[k]; }
		});
		}
		});
		}
		n.default = e;
		return Object.freeze(n);
		}

		var CBOR__namespace = /#__PURE__/_interopNamespaceDefault(CBOR);
		var x509__namespace = /#__PURE__/_interopNamespaceDefault(x509);

		const getCryptoInstance = async () => {
		let cryptoInstance;
		// Use globalThis.crypto.subtle if available
		if (typeof globalThis !== "undefined" && globalThis.crypto?.subtle) {
		cryptoInstance = globalThis.crypto;
		x509__namespace.cryptoProvider.set(cryptoInstance);
		return cryptoInstance;
		}
		try {
		// Dynamic import to prevent bundling in environments that already have WebCrypto
		const { Crypto: PeculiarCrypto } = await import('@peculiar/webcrypto');
		cryptoInstance = new PeculiarCrypto();
		x509__namespace.cryptoProvider.set(cryptoInstance);
		return cryptoInstance;
		}
		catch {
		// Happens usually on React Native
		throw new Error("No WebCrypto implementation found. " +
		"In React Native, please polyfill `global.crypto.subtle` (e.g., with `react-native-webcrypto`) " +
		"before calling verify().");
		}
		};
		/**
		* Utility: SHA-256 digest → hex (uppercase)
		*/
		async function sha256Hex(data) {
		const cryptoInstance = await getCryptoInstance();
		const digest = await cryptoInstance.subtle.digest("SHA-256", data);
		return encoding.uint8ArrayToHexString(new Uint8Array(digest)).toUpperCase();
		}
		/**
		* Utility: Import SPKI public key for ECDSA verify
		*/
		async function importEcdsaPublicKey(spki) {
		const cryptoInstance = await getCryptoInstance();
		return cryptoInstance.subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-384" }, // AWS Nitro uses ES384
		false, ["verify"]);
		}
		/**
		* verify goes through the following verification steps for an app proof & boot proof pair:
		* - Verify app proof signature
		* - Verify the boot proof
		* - Attestation doc was signed by AWS
		* - Attestation doc's `user_data` is the hash of the qos manifest
		* - Verify the connection between the app proof & boot proof i.e. that the ephemeral keys match
		*
		* For more information, check out https://whitepaper.turnkey.com/foundations
		*/
		async function verify(appProof, bootProof) {
		// 1. Verify App Proof
		verifyAppProofSignature(appProof);
		// 2. Verify Boot Proof
		// Parse attestation
		const coseSign1Der = Uint8Array.from(atob(bootProof.awsAttestationDocB64)
		.split("")
		.map((c) => c.charCodeAt(0)));
		const coseSign1 = CBOR__namespace.decode(coseSign1Der.buffer);
		const [, , payload] = coseSign1;
		const attestationDoc = CBOR__namespace.decode(new Uint8Array(payload).buffer);
		// Verify cose sign1 signature
		await verifyCoseSign1Sig(coseSign1, attestationDoc.certificate);
		// Verify certificate chain
		const appProofTimestampMs = parseInt(JSON.parse(appProof.proofPayload).timestampMs);
		await verifyCertificateChain(attestationDoc.cabundle, constants.AWS_ROOT_CERT_PEM, attestationDoc.certificate, appProofTimestampMs);
		// Verify manifest digest
		const decodedBootProofManifest = Uint8Array.from(atob(bootProof.qosManifestB64)
		.split("")
		.map((c) => c.charCodeAt(0)));
		const manifestDigest = sha2.sha256(decodedBootProofManifest);
		if (!bytesEq(manifestDigest, attestationDoc.user_data)) {
		throw new Error(`attestationDoc's user_data doesn't match the hash of the manifest. attestationDoc.user_data: ${attestationDoc.user_data} , manifest digest: ${manifestDigest}`);
		}
		// 3. Verify that all the ephemeral public keys match: app proof, boot proof structure, actual attestation doc
		const publicKeyBytes = new Uint8Array(attestationDoc.public_key);
		const attestationPubKey = encoding.uint8ArrayToHexString(publicKeyBytes);
		if (appProof.publicKey !== attestationPubKey \|\|
		attestationPubKey !== bootProof.ephemeralPublicKeyHex) {
		throw new Error(`Ephemeral pub keys from app proof: ${appProof.publicKey}, boot proof structure ${bootProof.ephemeralPublicKeyHex}, and attestation doc ${attestationPubKey} should all match`);
		}
		}
		/**
		* Verify app proof signature with @noble/curves
		*/
		function verifyAppProofSignature(appProof) {
		if (appProof.scheme !== "SIGNATURE_SCHEME_EPHEMERAL_KEY_P256") {
		throw new Error("Unsupported signature scheme");
		}
		// Decode public key
		let publicKeyBytes;
		try {
		publicKeyBytes = encoding.uint8ArrayFromHexString(appProof.publicKey);
		}
		catch {
		throw new Error("Failed to decode public key");
		}
		if (publicKeyBytes.length !== 130) {
		throw new Error(`Expected 130 bytes (encryption + signing pub keys), got ${publicKeyBytes.length} bytes`);
		}
		// Extract signing key (last 65 bytes, uncompressed P-256 point)
		const signingKeyBytes = publicKeyBytes.slice(65);
		if (signingKeyBytes.length !== 65 \|\| signingKeyBytes[0] !== 0x04) {
		throw new Error("Invalid signing key format: expected 65-byte uncompressed P-256 point (0x04\|\|X\|\|Y)");
		}
		// Validate it's a valid P-256 public key by attempting to create a point
		try {
		p256.p256.ProjectivePoint.fromHex(signingKeyBytes);
		}
		catch (error) {
		throw new Error(`Invalid P-256 public key: ${error}`);
		}
		// Decode signature (64 bytes = 32 bytes r + 32 bytes s)
		let signatureBytes;
		try {
		signatureBytes = encoding.uint8ArrayFromHexString(appProof.signature);
		}
		catch {
		throw new Error("Failed to decode signature");
		}
		if (signatureBytes.length !== 64) {
		throw new Error(`Expected 64 bytes signature (r\|\|s), got ${signatureBytes.length} bytes`);
		}
		// Hash the proof payload
		const payloadBytes = new TextEncoder().encode(appProof.proofPayload);
		const payloadDigest = sha2.sha256(payloadBytes);
		// Verify ECDSA signature
		const isValid = p256.p256.verify(signatureBytes, payloadDigest, signingKeyBytes);
		if (!isValid) {
		throw new Error("Signature verification failed");
		}
		}
		async function verifyCertificateChain(cabundle, rootCertPem, leafCert, timestampMs) {
		try {
		// Check root and assert fingerprint
		const rootX509 = new x509__namespace.X509Certificate(rootCertPem);
		const rootDer = new Uint8Array(rootX509.rawData);
		const rootSha = await sha256Hex(rootDer);
		if (rootSha !== constants.AWS_ROOT_CERT_SHA256) {
		throw new Error(`Pinned AWS root fingerprint mismatch: expected=${constants.AWS_ROOT_CERT_SHA256} actual=${rootSha}`);
		}
		// Bundle starts with root certificate. We're replacing the root with our hardcoded known certificate, so remove first element
		const bundleWithoutRoot = cabundle.slice(1);
		const intermediatesX509 = bundleWithoutRoot.map((c) => {
		if (!c)
		throw new Error("Invalid certificate data in cabundle");
		return new x509__namespace.X509Certificate(c);
		});
		const leaf = new x509__namespace.X509Certificate(leafCert);
		// Build path leaf → intermediates → root, with our hardcoded known root certificate
		const builder = new x509__namespace.X509ChainBuilder({
		certificates: [rootX509, ...intermediatesX509],
		});
		const chain = await builder.build(leaf);
		if (chain.length !== intermediatesX509.length + 2) {
		throw new Error(`Incorrect number of certs in X509 Chain. Expected ${intermediatesX509.length + 2}, got ${chain.length}`);
		}
		const appProofDate = new Date(timestampMs);
		for (let i = 0; i < chain.length; i++) {
		const cert = chain[i];
		if (!cert)
		throw new Error("Invalid certificate in chain");
		if (i === chain.length - 1) {
		// is root
		// Self-signature verification for root certificate
		const ok = await cert.verify({
		publicKey: cert.publicKey,
		date: appProofDate,
		});
		if (!ok)
		throw new Error("Pinned root failed self-signature verification");
		}
		else {
		// Verify signature against issuer
		const issuer = chain[i + 1];
		if (!issuer)
		throw new Error("Issuer can't be null");
		// Attestation docs technically expire after 3 hours, so an app proof generated 3+ hours after an enclave
		// boots up will fail verification due to certificate expiration. This is okay because enclaves are immutable;
		// even if the cert is technically invalid, the code contained within it cannot change. To prevent the cert
		// expiration failure, we set `signatureOnly: true`.
		const ok = await cert.verify({
		publicKey: issuer.publicKey,
		signatureOnly: true,
		date: appProofDate,
		});
		if (!ok) {
		throw new Error(`Signature check failed: ${cert.subject} not signed by ${issuer?.subject}`);
		}
		}
		}
		}
		catch (error) {
		throw new Error(`Certificate chain verification failed: ${error instanceof Error ? error.message : String(error)}`);
		}
		}
		async function verifyCoseSign1Sig(coseSign1, leaf) {
		const [protectedHeaders, , payload, signature] = coseSign1;
		const tbs = new Uint8Array(CBOR__namespace.encode([
		"Signature1",
		new Uint8Array(protectedHeaders),
		new Uint8Array(0),
		new Uint8Array(payload),
		]));
		const leafCert = new x509__namespace.X509Certificate(leaf);
		const pubKey = await importEcdsaPublicKey(leafCert.publicKey.rawData);
		const cryptoInstance = await getCryptoInstance();
		const ok = await cryptoInstance.subtle.verify({ name: "ECDSA", hash: { name: "SHA-384" } }, pubKey, new Uint8Array(signature), tbs);
		if (!ok)
		throw new Error("COSE_Sign1 ES384 verification failed");
		}
		function bytesEq(a, b) {
		const A = new Uint8Array(a), B = new Uint8Array(b);
		if (A.length !== B.length)
		return false;
		for (let i = 0; i < A.length; i++)
		if (A[i] !== B[i])
		return false;
		return true;
		}

		exports.getCryptoInstance = getCryptoInstance;
		exports.verify = verify;
		exports.verifyAppProofSignature = verifyAppProofSignature;
		exports.verifyCertificateChain = verifyCertificateChain;
		exports.verifyCoseSign1Sig = verifyCoseSign1Sig;
		//# sourceMappingURL=proof.js.map

+1

dist/proof.js.map

+228

dist/proof.mjs

		import { uint8ArrayToHexString, uint8ArrayFromHexString } from '@turnkey/encoding';
		import { p256 } from '@noble/curves/p256';
		import { sha256 } from '@noble/hashes/sha2';
		import * as CBOR from 'cbor-js';
		import * as x509 from '@peculiar/x509';
		import { AWS_ROOT_CERT_PEM, AWS_ROOT_CERT_SHA256 } from './constants.mjs';

		const getCryptoInstance = async () => {
		let cryptoInstance;
		// Use globalThis.crypto.subtle if available
		if (typeof globalThis !== "undefined" && globalThis.crypto?.subtle) {
		cryptoInstance = globalThis.crypto;
		x509.cryptoProvider.set(cryptoInstance);
		return cryptoInstance;
		}
		try {
		// Dynamic import to prevent bundling in environments that already have WebCrypto
		const { Crypto: PeculiarCrypto } = await import('@peculiar/webcrypto');
		cryptoInstance = new PeculiarCrypto();
		x509.cryptoProvider.set(cryptoInstance);
		return cryptoInstance;
		}
		catch {
		// Happens usually on React Native
		throw new Error("No WebCrypto implementation found. " +
		"In React Native, please polyfill `global.crypto.subtle` (e.g., with `react-native-webcrypto`) " +
		"before calling verify().");
		}
		};
		/**
		* Utility: SHA-256 digest → hex (uppercase)
		*/
		async function sha256Hex(data) {
		const cryptoInstance = await getCryptoInstance();
		const digest = await cryptoInstance.subtle.digest("SHA-256", data);
		return uint8ArrayToHexString(new Uint8Array(digest)).toUpperCase();
		}
		/**
		* Utility: Import SPKI public key for ECDSA verify
		*/
		async function importEcdsaPublicKey(spki) {
		const cryptoInstance = await getCryptoInstance();
		return cryptoInstance.subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-384" }, // AWS Nitro uses ES384
		false, ["verify"]);
		}
		/**
		* verify goes through the following verification steps for an app proof & boot proof pair:
		* - Verify app proof signature
		* - Verify the boot proof
		* - Attestation doc was signed by AWS
		* - Attestation doc's `user_data` is the hash of the qos manifest
		* - Verify the connection between the app proof & boot proof i.e. that the ephemeral keys match
		*
		* For more information, check out https://whitepaper.turnkey.com/foundations
		*/
		async function verify(appProof, bootProof) {
		// 1. Verify App Proof
		verifyAppProofSignature(appProof);
		// 2. Verify Boot Proof
		// Parse attestation
		const coseSign1Der = Uint8Array.from(atob(bootProof.awsAttestationDocB64)
		.split("")
		.map((c) => c.charCodeAt(0)));
		const coseSign1 = CBOR.decode(coseSign1Der.buffer);
		const [, , payload] = coseSign1;
		const attestationDoc = CBOR.decode(new Uint8Array(payload).buffer);
		// Verify cose sign1 signature
		await verifyCoseSign1Sig(coseSign1, attestationDoc.certificate);
		// Verify certificate chain
		const appProofTimestampMs = parseInt(JSON.parse(appProof.proofPayload).timestampMs);
		await verifyCertificateChain(attestationDoc.cabundle, AWS_ROOT_CERT_PEM, attestationDoc.certificate, appProofTimestampMs);
		// Verify manifest digest
		const decodedBootProofManifest = Uint8Array.from(atob(bootProof.qosManifestB64)
		.split("")
		.map((c) => c.charCodeAt(0)));
		const manifestDigest = sha256(decodedBootProofManifest);
		if (!bytesEq(manifestDigest, attestationDoc.user_data)) {
		throw new Error(`attestationDoc's user_data doesn't match the hash of the manifest. attestationDoc.user_data: ${attestationDoc.user_data} , manifest digest: ${manifestDigest}`);
		}
		// 3. Verify that all the ephemeral public keys match: app proof, boot proof structure, actual attestation doc
		const publicKeyBytes = new Uint8Array(attestationDoc.public_key);
		const attestationPubKey = uint8ArrayToHexString(publicKeyBytes);
		if (appProof.publicKey !== attestationPubKey \|\|
		attestationPubKey !== bootProof.ephemeralPublicKeyHex) {
		throw new Error(`Ephemeral pub keys from app proof: ${appProof.publicKey}, boot proof structure ${bootProof.ephemeralPublicKeyHex}, and attestation doc ${attestationPubKey} should all match`);
		}
		}
		/**
		* Verify app proof signature with @noble/curves
		*/
		function verifyAppProofSignature(appProof) {
		if (appProof.scheme !== "SIGNATURE_SCHEME_EPHEMERAL_KEY_P256") {
		throw new Error("Unsupported signature scheme");
		}
		// Decode public key
		let publicKeyBytes;
		try {
		publicKeyBytes = uint8ArrayFromHexString(appProof.publicKey);
		}
		catch {
		throw new Error("Failed to decode public key");
		}
		if (publicKeyBytes.length !== 130) {
		throw new Error(`Expected 130 bytes (encryption + signing pub keys), got ${publicKeyBytes.length} bytes`);
		}
		// Extract signing key (last 65 bytes, uncompressed P-256 point)
		const signingKeyBytes = publicKeyBytes.slice(65);
		if (signingKeyBytes.length !== 65 \|\| signingKeyBytes[0] !== 0x04) {
		throw new Error("Invalid signing key format: expected 65-byte uncompressed P-256 point (0x04\|\|X\|\|Y)");
		}
		// Validate it's a valid P-256 public key by attempting to create a point
		try {
		p256.ProjectivePoint.fromHex(signingKeyBytes);
		}
		catch (error) {
		throw new Error(`Invalid P-256 public key: ${error}`);
		}
		// Decode signature (64 bytes = 32 bytes r + 32 bytes s)
		let signatureBytes;
		try {
		signatureBytes = uint8ArrayFromHexString(appProof.signature);
		}
		catch {
		throw new Error("Failed to decode signature");
		}
		if (signatureBytes.length !== 64) {
		throw new Error(`Expected 64 bytes signature (r\|\|s), got ${signatureBytes.length} bytes`);
		}
		// Hash the proof payload
		const payloadBytes = new TextEncoder().encode(appProof.proofPayload);
		const payloadDigest = sha256(payloadBytes);
		// Verify ECDSA signature
		const isValid = p256.verify(signatureBytes, payloadDigest, signingKeyBytes);
		if (!isValid) {
		throw new Error("Signature verification failed");
		}
		}
		async function verifyCertificateChain(cabundle, rootCertPem, leafCert, timestampMs) {
		try {
		// Check root and assert fingerprint
		const rootX509 = new x509.X509Certificate(rootCertPem);
		const rootDer = new Uint8Array(rootX509.rawData);
		const rootSha = await sha256Hex(rootDer);
		if (rootSha !== AWS_ROOT_CERT_SHA256) {
		throw new Error(`Pinned AWS root fingerprint mismatch: expected=${AWS_ROOT_CERT_SHA256} actual=${rootSha}`);
		}
		// Bundle starts with root certificate. We're replacing the root with our hardcoded known certificate, so remove first element
		const bundleWithoutRoot = cabundle.slice(1);
		const intermediatesX509 = bundleWithoutRoot.map((c) => {
		if (!c)
		throw new Error("Invalid certificate data in cabundle");
		return new x509.X509Certificate(c);
		});
		const leaf = new x509.X509Certificate(leafCert);
		// Build path leaf → intermediates → root, with our hardcoded known root certificate
		const builder = new x509.X509ChainBuilder({
		certificates: [rootX509, ...intermediatesX509],
		});
		const chain = await builder.build(leaf);
		if (chain.length !== intermediatesX509.length + 2) {
		throw new Error(`Incorrect number of certs in X509 Chain. Expected ${intermediatesX509.length + 2}, got ${chain.length}`);
		}
		const appProofDate = new Date(timestampMs);
		for (let i = 0; i < chain.length; i++) {
		const cert = chain[i];
		if (!cert)
		throw new Error("Invalid certificate in chain");
		if (i === chain.length - 1) {
		// is root
		// Self-signature verification for root certificate
		const ok = await cert.verify({
		publicKey: cert.publicKey,
		date: appProofDate,
		});
		if (!ok)
		throw new Error("Pinned root failed self-signature verification");
		}
		else {
		// Verify signature against issuer
		const issuer = chain[i + 1];
		if (!issuer)
		throw new Error("Issuer can't be null");
		// Attestation docs technically expire after 3 hours, so an app proof generated 3+ hours after an enclave
		// boots up will fail verification due to certificate expiration. This is okay because enclaves are immutable;
		// even if the cert is technically invalid, the code contained within it cannot change. To prevent the cert
		// expiration failure, we set `signatureOnly: true`.
		const ok = await cert.verify({
		publicKey: issuer.publicKey,
		signatureOnly: true,
		date: appProofDate,
		});
		if (!ok) {
		throw new Error(`Signature check failed: ${cert.subject} not signed by ${issuer?.subject}`);
		}
		}
		}
		}
		catch (error) {
		throw new Error(`Certificate chain verification failed: ${error instanceof Error ? error.message : String(error)}`);
		}
		}
		async function verifyCoseSign1Sig(coseSign1, leaf) {
		const [protectedHeaders, , payload, signature] = coseSign1;
		const tbs = new Uint8Array(CBOR.encode([
		"Signature1",
		new Uint8Array(protectedHeaders),
		new Uint8Array(0),
		new Uint8Array(payload),
		]));
		const leafCert = new x509.X509Certificate(leaf);
		const pubKey = await importEcdsaPublicKey(leafCert.publicKey.rawData);
		const cryptoInstance = await getCryptoInstance();
		const ok = await cryptoInstance.subtle.verify({ name: "ECDSA", hash: { name: "SHA-384" } }, pubKey, new Uint8Array(signature), tbs);
		if (!ok)
		throw new Error("COSE_Sign1 ES384 verification failed");
		}
		function bytesEq(a, b) {
		const A = new Uint8Array(a), B = new Uint8Array(b);
		if (A.length !== B.length)
		return false;
		for (let i = 0; i < A.length; i++)
		if (A[i] !== B[i])
		return false;
		return true;
		}

		export { getCryptoInstance, verify, verifyAppProofSignature, verifyCertificateChain, verifyCoseSign1Sig };
		//# sourceMappingURL=proof.mjs.map

+1

dist/proof.mjs.map

+9

-0

CHANGELOG.md

		# @turnkey/crypto

		## 2.8.3

		### Patch Changes

		- [#992](https://github.com/tkhq/sdk/pull/992) [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186) Author [@amircheikh](https://github.com/amircheikh) - - `verify` function is now exposed and supports web platforms

		- Updated dependencies [[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]:
		- @turnkey/sdk-types@0.6.3

		## 2.8.2
		@@ -4,0 +13,0 @@

+19

-0

dist/constants.js

		@@ -33,4 +33,23 @@ 'use strict';
		const PRODUCTION_ON_RAMP_CREDENTIALS_ENCRYPTION_PUBLIC_KEY = "02336ebd7e929ef64b87c776b72540255b4c7b41579a24b1e68fb060daa873f9f6";
		// Pinned AWS Nitro Enclaves Root
		const AWS_ROOT_CERT_PEM = `-----BEGIN CERTIFICATE-----
		MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
		MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
		VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
		MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL
		DANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG
		BSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb
		48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE
		h8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF
		R+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC
		MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
		rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
		IwLz3/Y=
		-----END CERTIFICATE-----`;
		// Official SHA-256 fingerprint
		const AWS_ROOT_CERT_SHA256 = "641A0321A3E244EFE456463195D606317ED7CDCC3C1756E09893F3C68F79BB5B";

		exports.AES_KEY_INFO = AES_KEY_INFO;
		exports.AWS_ROOT_CERT_PEM = AWS_ROOT_CERT_PEM;
		exports.AWS_ROOT_CERT_SHA256 = AWS_ROOT_CERT_SHA256;
		exports.HPKE_VERSION = HPKE_VERSION;
		@@ -37,0 +56,0 @@ exports.IV_INFO = IV_INFO;

+18

-1

dist/constants.mjs

		@@ -31,4 +31,21 @@ const SUITE_ID_1 = new Uint8Array([75, 69, 77, 0, 16]); //KEM suite ID
		const PRODUCTION_ON_RAMP_CREDENTIALS_ENCRYPTION_PUBLIC_KEY = "02336ebd7e929ef64b87c776b72540255b4c7b41579a24b1e68fb060daa873f9f6";
		// Pinned AWS Nitro Enclaves Root
		const AWS_ROOT_CERT_PEM = `-----BEGIN CERTIFICATE-----
		MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
		MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
		VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
		MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL
		DANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG
		BSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb
		48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE
		h8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF
		R+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC
		MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
		rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
		IwLz3/Y=
		-----END CERTIFICATE-----`;
		// Official SHA-256 fingerprint
		const AWS_ROOT_CERT_SHA256 = "641A0321A3E244EFE456463195D606317ED7CDCC3C1756E09893F3C68F79BB5B";

		export { AES_KEY_INFO, HPKE_VERSION, IV_INFO, LABEL_EAE_PRK, LABEL_SECRET, LABEL_SHARED_SECRET, PRODUCTION_NOTARIZER_SIGN_PUBLIC_KEY, PRODUCTION_ON_RAMP_CREDENTIALS_ENCRYPTION_PUBLIC_KEY, PRODUCTION_SIGNER_SIGN_PUBLIC_KEY, PRODUCTION_TLS_FETCHER_ENCRYPT_PUBLIC_KEY, QOS_ENCRYPTION_HMAC_MESSAGE, QUORUM_ENCRYPT_NONCE_LENGTH_BYTES, SUITE_ID_1, SUITE_ID_2, UNCOMPRESSED_PUB_KEY_LENGTH_BYTES };
		export { AES_KEY_INFO, AWS_ROOT_CERT_PEM, AWS_ROOT_CERT_SHA256, HPKE_VERSION, IV_INFO, LABEL_EAE_PRK, LABEL_SECRET, LABEL_SHARED_SECRET, PRODUCTION_NOTARIZER_SIGN_PUBLIC_KEY, PRODUCTION_ON_RAMP_CREDENTIALS_ENCRYPTION_PUBLIC_KEY, PRODUCTION_SIGNER_SIGN_PUBLIC_KEY, PRODUCTION_TLS_FETCHER_ENCRYPT_PUBLIC_KEY, QOS_ENCRYPTION_HMAC_MESSAGE, QUORUM_ENCRYPT_NONCE_LENGTH_BYTES, SUITE_ID_1, SUITE_ID_2, UNCOMPRESSED_PUB_KEY_LENGTH_BYTES };
		//# sourceMappingURL=constants.mjs.map

+1

-0

dist/index.d.ts

		export * from "./crypto";
		export * from "./turnkey";
		export * from "./proof";
		//# sourceMappingURL=index.d.ts.map

+6

-0

dist/index.js

		@@ -5,2 +5,3 @@ 'use strict';
		var turnkey = require('./turnkey.js');
		var proof = require('./proof.js');

		@@ -35,2 +36,7 @@
		exports.verifyStampSignature = turnkey.verifyStampSignature;
		exports.getCryptoInstance = proof.getCryptoInstance;
		exports.verify = proof.verify;
		exports.verifyAppProofSignature = proof.verifyAppProofSignature;
		exports.verifyCertificateChain = proof.verifyCertificateChain;
		exports.verifyCoseSign1Sig = proof.verifyCoseSign1Sig;
		//# sourceMappingURL=index.js.map

+1

-0

dist/index.mjs

		export { buildAdditionalAssociatedData, compressRawPublicKey, extractPrivateKeyFromPKCS8Bytes, formatHpkeBuf, fromDerSignature, generateP256KeyPair, getPublicKey, hpkeAuthEncrypt, hpkeDecrypt, hpkeEncrypt, quorumKeyEncrypt, toDerSignature, uncompressRawPublicKey } from './crypto.mjs';
		export { Enclave, decryptCredentialBundle, decryptExportBundle, encryptOauth2ClientSecret, encryptOnRampSecret, encryptPrivateKeyToBundle, encryptToEnclave, encryptWalletToBundle, verifySessionJwtSignature, verifyStampSignature } from './turnkey.mjs';
		export { getCryptoInstance, verify, verifyAppProofSignature, verifyCertificateChain, verifyCoseSign1Sig } from './proof.mjs';
		//# sourceMappingURL=index.mjs.map

+6

-2

dist/proof.d.ts

		import type { v1AppProof, v1BootProof } from "@turnkey/sdk-types";
		export declare const getCryptoInstance: () => Promise<Crypto>;
		/**
		@@ -10,8 +11,11 @@ * verify goes through the following verification steps for an app proof & boot proof pair:
		*
		* For more information, check out https://whitepaper.turnkey.com/foundations
		* For more information, check out https://whitepaper.turnkey.com/foundations
		*/
		export declare function verify(appProof: v1AppProof, bootProof: v1BootProof): Promise<void>;
		/**
		* Verify app proof signature with @noble/curves
		*/
		export declare function verifyAppProofSignature(appProof: v1AppProof): void;
		export declare function verifyCertificateChain(cabundle: Uint8Array[], rootCertPem: string, leafCert: Uint8Array, timestampMs: number): Promise<void>;
		export declare function verifyCoseSign1Sig(coseSign1: any, leaf: Uint8Array): void;
		export declare function verifyCoseSign1Sig(coseSign1: any, leaf: Uint8Array): Promise<void>;
		//# sourceMappingURL=proof.d.ts.map

+2

-2

package.json

		{
		"name": "@turnkey/crypto",
		"version": "2.8.2",
		"version": "2.8.3",
		"main": "./dist/index.js",
		@@ -46,3 +46,3 @@ "module": "./dist/index.mjs",
		"@turnkey/encoding": "0.6.0",
		"@turnkey/sdk-types": "0.6.2"
		"@turnkey/sdk-types": "0.6.3"
		},
		@@ -49,0 +49,0 @@ "devDependencies": {

dist/constants.js.map