@bradford-tech/supabase-integrity-attest 0.2.3 → 0.3.0

package/esm/assertion.d.ts

@@ -0,0 +1,4 @@
+export { verifyAssertion } from "./src/assertion.js";
+export type { AppInfo, AssertionResult } from "./src/assertion.js";
+export { AssertionError, AssertionErrorCode } from "./src/errors.js";
+//# sourceMappingURL=assertion.d.ts.map

package/esm/assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../src/assertion.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}

package/esm/assertion.js

@@ -0,0 +1,3 @@
+// assertion.ts — lightweight entry point (no asn1js / @noble/curves)
+export { verifyAssertion } from "./src/assertion.js";
+export { AssertionError, AssertionErrorCode } from "./src/errors.js";

package/esm/attestation.d.ts

@@ -0,0 +1,4 @@
+export { verifyAttestation } from "./src/attestation.js";
+export type { AppInfo, AttestationResult, VerifyAttestationOptions, } from "./src/attestation.js";
+export { AttestationError, AttestationErrorCode } from "./src/errors.js";
+//# sourceMappingURL=attestation.d.ts.map

package/esm/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EACV,OAAO,EACP,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}

package/esm/attestation.js

@@ -0,0 +1,3 @@
+// attestation.ts — full attestation entry point (includes cert chain deps)
+export { verifyAttestation } from "./src/attestation.js";
+export { AttestationError, AttestationErrorCode } from "./src/errors.js";

package/esm/src/assertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../../src/src/assertion.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,UAAU,GAAG,MAAM,EAC9B,UAAU,EAAE,UAAU,GAAG,MAAM,EAC/B,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,eAAe,CAAC,CAqG1B"}
+{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../../src/src/assertion.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,UAAU,GAAG,MAAM,EAC9B,UAAU,EAAE,UAAU,GAAG,MAAM,EAC/B,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,eAAe,CAAC,CA2G1B"}

package/esm/src/assertion.js

@@ -37,8 +37,9 @@ export async function verifyAssertion(appInfo, assertion, clientData, publicKeyP
     }
     // Step 5: Compute clientDataHash
     const clientDataHash = new Uint8Array(await crypto.subtle.digest("SHA-256", clientDataBytes));
-    // Step 6: Build message = authenticatorData || clientDataHash
-    const message = concat(decoded.authenticatorData, clientDataHash);
+    // Step 6: Compute nonce = SHA-256(authenticatorData || clientDataHash)
+    // Apple signs this nonce as the message to ES256 (not authData || clientDataHash directly)
+    const nonce = new Uint8Array(await crypto.subtle.digest("SHA-256", concat(decoded.authenticatorData, clientDataHash)));
     // Step 7: Convert DER signature to raw r||s
     let signatureRaw;
     try {
@@ -55,8 +56,8 @@ export async function verifyAssertion(appInfo, assertion, clientData, publicKeyP
     catch (e) {
         throw new AssertionError(AssertionErrorCode.INVALID_FORMAT, `Invalid public key PEM: ${e instanceof Error ? e.message : String(e)}`);
     }
-    // Step 9: Verify ECDSA signature
-    const valid = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, publicKey, signatureRaw, message);
+    // Step 9: Verify ECDSA signature over nonce
+    const valid = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, publicKey, signatureRaw, nonce);
     if (!valid) {
         throw new AssertionError(AssertionErrorCode.SIGNATURE_INVALID, "ECDSA signature verification failed");
     }

package/esm/tests/assertion-entry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion-entry.test.d.ts","sourceRoot":"","sources":["../../src/tests/assertion-entry.test.ts"],"names":[],"mappings":""}

package/esm/tests/attestation-entry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-entry.test.d.ts","sourceRoot":"","sources":["../../src/tests/attestation-entry.test.ts"],"names":[],"mappings":""}

package/esm/tests/fixtures/generate-assertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-assertion.d.ts","sourceRoot":"","sources":["../../../src/tests/fixtures/generate-assertion.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,UAAU,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAiDnC"}
+{"version":3,"file":"generate-assertion.d.ts","sourceRoot":"","sources":["../../../src/tests/fixtures/generate-assertion.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,UAAU,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAuDnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bradford-tech/supabase-integrity-attest",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "Verify Apple App Attest attestations and assertions using WebCrypto.",
   "repository": {
     "type": "git",
@@ -14,6 +14,12 @@
   "exports": {
     ".": {
       "import": "./esm/mod.js"
+    },
+    "./assertion": {
+      "import": "./esm/assertion.js"
+    },
+    "./attestation": {
+      "import": "./esm/attestation.js"
     }
   },
   "scripts": {