@ohos-ports/trezor-device-authenticity 1.1.2-beta.1

package/lib/x509certificate.js

@@ -0,0 +1,277 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.parseCertificate = exports.parseName = void 0;
+const parseOidToAlgorithmName = oid => {
+  if (oid === '1.2.840.10045.4.3.2') return 'P-256';
+  if (oid === '1.3.101.112') return 'Ed25519';
+  return 'unknown';
+};
+const derToAsn1 = byteArray => {
+  let position = 0;
+  function getTag() {
+    let tag = byteArray[0] & 0x1f;
+    position += 1;
+    if (tag === 0x1f) {
+      tag = 0;
+      while (byteArray[position] >= 0x80) {
+        tag = tag * 128 + byteArray[position] - 0x80;
+        position += 1;
+      }
+      tag = tag * 128 + byteArray[position] - 0x80;
+      position += 1;
+    }
+    return tag;
+  }
+  function getLength() {
+    let length = 0;
+    if (byteArray[position] < 0x80) {
+      length = byteArray[position];
+      position += 1;
+    } else {
+      const numberOfDigits = byteArray[position] & 0x7f;
+      position += 1;
+      length = 0;
+      for (let i = 0; i < numberOfDigits; i++) {
+        length = length * 256 + byteArray[position];
+        position += 1;
+      }
+    }
+    return length;
+  }
+  const cls = (byteArray[0] & 0xc0) / 64;
+  const structured = (byteArray[0] & 0x20) === 0x20;
+  const tag = getTag();
+  if (byteArray[position] === 0x80) {
+    throw new Error('Unsupported length encoding');
+  }
+  const length = getLength();
+  const byteLength = position + length;
+  const contents = byteArray.subarray(position, byteLength);
+  const raw = byteArray.subarray(0, byteLength);
+  return {
+    cls,
+    tag,
+    structured,
+    byteLength,
+    contents,
+    raw
+  };
+};
+const derToAsn1List = byteArray => {
+  const result = [];
+  let nextPosition = 0;
+  while (nextPosition < byteArray.length) {
+    const nextPiece = derToAsn1(byteArray.subarray(nextPosition));
+    result.push(nextPiece);
+    nextPosition += nextPiece.byteLength;
+  }
+  return result;
+};
+const derBitStringValue = byteArray => ({
+  unusedBits: byteArray[0],
+  bytes: byteArray.subarray(1)
+});
+const parseSignatureValue = asn1 => {
+  if (asn1.cls !== 0 || asn1.tag !== 3 || asn1.structured) {
+    throw new Error('Bad signature value. Not a BIT STRING.');
+  }
+  return {
+    asn1,
+    bits: derBitStringValue(asn1.contents)
+  };
+};
+const derObjectIdentifierValue = byteArray => {
+  let oid = `${Math.floor(byteArray[0] / 40)}.${byteArray[0] % 40}`;
+  let position = 1;
+  while (position < byteArray.length) {
+    let nextInteger = 0;
+    while (byteArray[position] >= 0x80) {
+      nextInteger = nextInteger * 0x80 + (byteArray[position] & 0x7f);
+      position += 1;
+    }
+    nextInteger = nextInteger * 0x80 + byteArray[position];
+    position += 1;
+    oid += `.${nextInteger}`;
+  }
+  return oid;
+};
+const parseAlgorithmIdentifier = asn1 => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error('Bad algorithm identifier. Not a SEQUENCE.');
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length > 2) {
+    throw new Error('Bad algorithm identifier. Contains too many child objects.');
+  }
+  const encodedAlgorithm = pieces[0];
+  if (encodedAlgorithm.cls !== 0 || encodedAlgorithm.tag !== 6 || encodedAlgorithm.structured) {
+    throw new Error('Bad algorithm identifier. Does not begin with an OBJECT IDENTIFIER.');
+  }
+  const algorithmOid = derObjectIdentifierValue(encodedAlgorithm.contents);
+  const algorithmName = parseOidToAlgorithmName(algorithmOid);
+  return {
+    asn1,
+    algorithmOid,
+    algorithmName,
+    parameters: pieces.length === 2 ? {
+      asn1: pieces[1]
+    } : null
+  };
+};
+const parseName = asn1 => derToAsn1List(asn1.contents).map(item => {
+  const attrSet = derToAsn1(item.contents);
+  return parseAlgorithmIdentifier(attrSet);
+});
+exports.parseName = parseName;
+const parseSubjectPublicKeyInfo = asn1 => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error('Bad SPKI. Not a SEQUENCE.');
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 2) {
+    throw new Error('Bad SubjectPublicKeyInfo. Wrong number of child objects.');
+  }
+  return {
+    asn1,
+    algorithm: parseAlgorithmIdentifier(pieces[0]),
+    bits: derBitStringValue(pieces[1].contents)
+  };
+};
+const parseUtcTime = time => {
+  let offset = 4;
+  let yearOffset = 0;
+  if (time.tag === 23) {
+    offset = 2;
+    yearOffset = 2000;
+  }
+  const utc = Buffer.from(time.contents).toString();
+  const year = yearOffset + Number(utc.substring(0, offset));
+  const month = Number(utc.substring(offset, offset + 2)) - 1;
+  const day = Number(utc.substring(offset + 2, offset + 4));
+  const hour = Number(utc.substring(offset + 4, offset + 6));
+  const minute = Number(utc.substring(offset + 6, offset + 8));
+  const date = new Date();
+  date.setUTCFullYear(year, month, day);
+  date.setUTCHours(hour, minute, 0);
+  return date;
+};
+const parseValidity = asn1 => {
+  const [from, to] = derToAsn1List(asn1.contents);
+  return {
+    from: parseUtcTime(from),
+    to: parseUtcTime(to)
+  };
+};
+const parseExtensions = data => {
+  const asn1 = derToAsn1(data.contents);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a Extension. Wrong data type.");
+  }
+  const readBoolean = value => {
+    if (!value) return false;
+    if (value.cls !== 0 || value.tag !== 1 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a boolean. Wrong data type.");
+    }
+    if (![0x00, 0xff].includes(value.contents[0])) {
+      throw new Error('Invalid boolean value.');
+    }
+    return value.contents[0] === 0xff;
+  };
+  const readBitString = uint8Array => {
+    const buffer = Buffer.from(uint8Array);
+    const tag = buffer.readUInt8(0);
+    if (tag !== 3) {
+      throw new Error("This can't be a bit string. Wrong data type.");
+    }
+    const length = buffer.readUInt8(1);
+    const unusedBits = buffer.readUInt8(2);
+    const bitStringBytes = buffer.subarray(3, 3 + length - 1);
+    const bitString = bitStringBytes.reduce((str, byte) => str + byte.toString(2).padStart(8, '0'), '');
+    return bitString.slice(0, bitString.length - unusedBits);
+  };
+  const readInteger = value => {
+    if (!value) return undefined;
+    if (value.cls !== 0 || value.tag !== 2 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a integer. Wrong data type.");
+    }
+    return Buffer.from(value.contents).readInt8();
+  };
+  const extensions = [];
+  derToAsn1List(asn1.contents).forEach(item => {
+    const [id, ...pieces] = derToAsn1List(item.contents);
+    if (id.cls !== 0 || id.tag !== 6 || id.structured) {
+      throw new Error('Bad extension. Does not begin with an OBJECT IDENTIFIER.');
+    }
+    const algorithm = derObjectIdentifierValue(id.contents);
+    const critical = pieces.length > 1 ? readBoolean(pieces[0]) : false;
+    const extnValue = pieces.length > 1 ? pieces[1] : pieces[0];
+    if (extnValue.cls !== 0 || extnValue.tag !== 4 || extnValue.structured) {
+      throw new Error("This can't be a octet string. Wrong data type.");
+    }
+    if (algorithm === '2.5.29.15') {
+      extensions.push({
+        key: 'keyUsage',
+        critical,
+        keyCertSign: readBitString(extnValue.contents)[5]
+      });
+    } else if (algorithm === '2.5.29.19') {
+      const fields = derToAsn1List(derToAsn1(extnValue.contents).contents);
+      const ca = fields.length > 0 && fields[0].tag === 1 ? fields[0] : undefined;
+      const len = fields.length > 0 && fields[0].tag === 2 ? fields[0] : fields[1];
+      extensions.push({
+        key: 'basicConstraints',
+        critical,
+        cA: readBoolean(ca),
+        pathLenConstraint: readInteger(len)
+      });
+    } else {
+      extensions.push({
+        key: algorithm,
+        critical,
+        ...item
+      });
+    }
+  });
+  return extensions;
+};
+const parseTBSCertificate = asn1 => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a TBSCertificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length < 7) {
+    throw new Error('Bad TBS Certificate. There are fewer than the seven required children.');
+  }
+  return {
+    asn1,
+    version: pieces[0],
+    serialNumber: pieces[1],
+    signature: parseAlgorithmIdentifier(pieces[2]),
+    issuer: pieces[3],
+    validity: parseValidity(pieces[4]),
+    subject: (0, exports.parseName)(pieces[5]),
+    subjectPublicKeyInfo: parseSubjectPublicKeyInfo(pieces[6]),
+    extensions: parseExtensions(pieces[7])
+  };
+};
+const parseCertificate = byteArray => {
+  const asn1 = derToAsn1(byteArray);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be an X.509 certificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 3) {
+    throw new Error('Certificate contains more than the three specified children.');
+  }
+  return {
+    asn1,
+    tbsCertificate: parseTBSCertificate(pieces[0]),
+    signatureAlgorithm: parseAlgorithmIdentifier(pieces[1]),
+    signatureValue: parseSignatureValue(pieces[2])
+  };
+};
+exports.parseCertificate = parseCertificate;
+//# sourceMappingURL=x509certificate.js.map

package/libESM/config/deviceAuthenticityBlacklistConfig.d.ts

@@ -0,0 +1,3 @@
+import type { DeviceAuthenticityBlacklistConfig } from './deviceAuthenticityBlacklistConfigTypes';
+export declare const deviceAuthenticityBlacklistConfig: DeviceAuthenticityBlacklistConfig;
+//# sourceMappingURL=deviceAuthenticityBlacklistConfig.d.ts.map

package/libESM/config/deviceAuthenticityBlacklistConfig.js

@@ -0,0 +1,8 @@
+export const deviceAuthenticityBlacklistConfig = {
+  version: 1,
+  blacklistedCaPubKeys: [],
+  debug: {
+    blacklistedCaPubKeys: []
+  }
+};
+//# sourceMappingURL=deviceAuthenticityBlacklistConfig.js.map

package/libESM/config/deviceAuthenticityBlacklistConfigTypes.d.ts

@@ -0,0 +1,11 @@
+import { Static } from '@trezor/schema-utils';
+export type DeviceAuthenticityBlacklistConfig = Static<typeof DeviceAuthenticityBlacklistConfig>;
+export declare const DeviceAuthenticityBlacklistConfig: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+    blacklistedCaPubKeys: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+}>, import("@sinclair/typebox").TObject<{
+    version: import("@sinclair/typebox").TNumber;
+    debug: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        blacklistedCaPubKeys: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    }>>;
+}>]>;
+//# sourceMappingURL=deviceAuthenticityBlacklistConfigTypes.d.ts.map

package/libESM/config/deviceAuthenticityBlacklistConfigTypes.js

@@ -0,0 +1,9 @@
+import { Type } from "@trezor/schema-utils";
+const CertPubKeysBlacklist = Type.Object({
+  blacklistedCaPubKeys: Type.Array(Type.String())
+});
+export const DeviceAuthenticityBlacklistConfig = Type.Intersect([CertPubKeysBlacklist, Type.Object({
+  version: Type.Number(),
+  debug: Type.Optional(CertPubKeysBlacklist)
+})]);
+//# sourceMappingURL=deviceAuthenticityBlacklistConfigTypes.js.map

package/libESM/config/deviceAuthenticityConfig.d.ts

@@ -0,0 +1,3 @@
+import type { DeviceAuthenticityConfig } from './deviceAuthenticityConfigTypes';
+export declare const deviceAuthenticityConfig: DeviceAuthenticityConfig;
+//# sourceMappingURL=deviceAuthenticityConfig.d.ts.map

package/libESM/config/deviceAuthenticityConfig.js

@@ -0,0 +1,30 @@
+export const deviceAuthenticityConfig = {
+  version: 2,
+  T2B1: {
+    rootPubKeysOptiga: ['04ca97480ac0d7b1e6efafe518cd433cec2bf8ab9822d76eafd34363b55d63e60380bff20acc75cde03cffcb50ab6f8ce70c878e37ebc58ff7cca0a83b16b15fa5'],
+    debug: {
+      rootPubKeysOptiga: ['047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a']
+    }
+  },
+  T3B1: {
+    rootPubKeysOptiga: ['045b5c3fdd01f3602092834209b86df0ca86a9faf25cac35c73bf6237d66eb21eafcec3706f1ccd5eb4cc7f2fa1751213eccb1c78389afba89a5788ff31ee46a5d'],
+    debug: {
+      rootPubKeysOptiga: ['047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a']
+    }
+  },
+  T3T1: {
+    rootPubKeysOptiga: ['041854b27fb1d9f65abb66828e78c9dc0ca301e66081ab0c6a4d104f9df1cd0ad5a7c75f77a8c092f55cf825d2abaf734f934c9394d5e75f75a5a06a5ee9be93ae'],
+    debug: {
+      rootPubKeysOptiga: ['04e48b69cd7962068d3cca3bcc6b1747ef496c1e28b5529e34ad7295215ea161dbe8fb08ae0479568f9d2cb07630cb3e52f4af0692102da5873559e45e9fa72959']
+    }
+  },
+  T3W1: {
+    rootPubKeysOptiga: ['040dde0d3e0d4da593fac6fd02a461d0e7eef238aca55c7c50b4e9ec37f3873303b6429ef1c9b78b4411a7dcbbc5dde5225979c1c2da3b073e82b1ed3f5f9825bb'],
+    rootPubKeysTropic: ['59237acd17134061d655b3f8d624573ca06ce8d862f38ba4e05140ce1d3d609d'],
+    debug: {
+      rootPubKeysOptiga: ['04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578'],
+      rootPubKeysTropic: []
+    }
+  }
+};
+//# sourceMappingURL=deviceAuthenticityConfig.js.map

package/libESM/config/deviceAuthenticityConfigTypes.d.ts

@@ -0,0 +1,47 @@
+import { Static } from '@trezor/schema-utils';
+export type DeviceAuthenticityConfig = Static<typeof DeviceAuthenticityConfig>;
+export declare const DeviceAuthenticityConfig: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+    T2B1: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+        rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>, import("@sinclair/typebox").TObject<{
+        debug: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>>;
+    }>]>;
+    T3B1: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+        rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>, import("@sinclair/typebox").TObject<{
+        debug: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>>;
+    }>]>;
+    T3T1: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+        rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>, import("@sinclair/typebox").TObject<{
+        debug: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>>;
+    }>]>;
+    T3W1: import("@sinclair/typebox").TIntersect<[import("@sinclair/typebox").TObject<{
+        rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>, import("@sinclair/typebox").TObject<{
+        debug: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            rootPubKeysOptiga: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            rootPubKeysTropic: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>>;
+    }>]>;
+}>, import("@sinclair/typebox").TObject<{
+    T1B1: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUndefined>;
+    T2T1: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUndefined>;
+    UNKNOWN: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUndefined>;
+}>]>, import("@sinclair/typebox").TObject<{
+    version: import("@sinclair/typebox").TNumber;
+}>]>;
+//# sourceMappingURL=deviceAuthenticityConfigTypes.d.ts.map

package/libESM/config/deviceAuthenticityConfigTypes.js

@@ -0,0 +1,15 @@
+import { MessagesSchema as PROTO } from "@trezor/protobuf";
+import { Type } from "@trezor/schema-utils";
+const CertPubKeys = Type.Object({
+  rootPubKeysOptiga: Type.Array(Type.String()),
+  rootPubKeysTropic: Type.Optional(Type.Array(Type.String()))
+});
+const ModelsWithKeys = Type.Exclude(Type.KeyOfEnum(PROTO.DeviceModelInternal), Type.Union([Type.Literal('T1B1'), Type.Literal('T2T1'), Type.Literal('UNKNOWN')]));
+const ModelsWithoutKeys = Type.Extract(Type.KeyOfEnum(PROTO.DeviceModelInternal), Type.Union([Type.Literal('T1B1'), Type.Literal('T2T1'), Type.Literal('UNKNOWN')]));
+const ModelPubKeys = Type.Intersect([Type.Record(ModelsWithKeys, Type.Intersect([CertPubKeys, Type.Object({
+  debug: Type.Optional(CertPubKeys)
+})])), Type.Partial(Type.Record(ModelsWithoutKeys, Type.Undefined()))]);
+export const DeviceAuthenticityConfig = Type.Intersect([ModelPubKeys, Type.Object({
+  version: Type.Number()
+})]);
+//# sourceMappingURL=deviceAuthenticityConfigTypes.js.map

package/libESM/index.d.ts

@@ -0,0 +1,9 @@
+export { verifyAuthenticityProof, verifySignatureP256 } from './verifyAuthenticityProof';
+export { type AlgorithmName, parseName, parseCertificate } from './x509certificate';
+export { getRandomChallenge } from './utils';
+export type { VerifySignature, VerifyAuthenticityProofParams, VerifyAuthenticityProofResult, } from './types';
+export { deviceAuthenticityBlacklistConfig } from './config/deviceAuthenticityBlacklistConfig';
+export { DeviceAuthenticityBlacklistConfig } from './config/deviceAuthenticityBlacklistConfigTypes';
+export { deviceAuthenticityConfig } from './config/deviceAuthenticityConfig';
+export { DeviceAuthenticityConfig } from './config/deviceAuthenticityConfigTypes';
+//# sourceMappingURL=index.d.ts.map

package/libESM/index.js

@@ -0,0 +1,8 @@
+export { verifyAuthenticityProof, verifySignatureP256 } from "./verifyAuthenticityProof.js";
+export { parseName, parseCertificate } from "./x509certificate.js";
+export { getRandomChallenge } from "./utils.js";
+export { deviceAuthenticityBlacklistConfig } from "./config/deviceAuthenticityBlacklistConfig.js";
+export { DeviceAuthenticityBlacklistConfig } from "./config/deviceAuthenticityBlacklistConfigTypes.js";
+export { deviceAuthenticityConfig } from "./config/deviceAuthenticityConfig.js";
+export { DeviceAuthenticityConfig } from "./config/deviceAuthenticityConfigTypes.js";
+//# sourceMappingURL=index.js.map

package/libESM/tsconfig.libESM.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["../src/index.ts","../src/types.ts","../src/utils.ts","../src/verifyAuthenticityProof.ts","../src/x509certificate.ts","../src/config/deviceAuthenticityBlacklistConfig.ts","../src/config/deviceAuthenticityBlacklistConfigTypes.ts","../src/config/deviceAuthenticityConfig.ts","../src/config/deviceAuthenticityConfigTypes.ts"],"version":"5.8.3"}

package/libESM/types.d.ts

@@ -0,0 +1,27 @@
+import { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { DeviceAuthenticityBlacklistConfig } from './config/deviceAuthenticityBlacklistConfigTypes';
+import type { DeviceAuthenticityConfig } from './config/deviceAuthenticityConfigTypes';
+export type VerifySignature = (rawKey: Buffer, data: Uint8Array, signature: Uint8Array) => boolean | Promise<boolean>;
+export type VerifyAuthenticityProofParams = {
+    challenge: Buffer;
+    certificates: string[];
+    signature: string;
+    deviceModel: keyof typeof PROTO.DeviceModelInternal;
+    config: DeviceAuthenticityConfig;
+    blacklistConfig: DeviceAuthenticityBlacklistConfig;
+    allowDebugKeys?: boolean;
+    challengePrefix?: string;
+    bufferChunks?: Buffer[];
+};
+export type VerifyAuthenticityProofResult = {
+    valid: true;
+    caPubKey: string;
+    rootPubKey: string;
+    error?: typeof undefined;
+} | {
+    valid: false;
+    caPubKey?: string;
+    rootPubKey?: string;
+    error: 'ROOT_PUBKEY_NOT_FOUND' | 'CA_PUBKEY_BLACKLISTED' | 'INVALID_DEVICE_MODEL' | 'INVALID_DEVICE_CERTIFICATE' | 'INVALID_DEVICE_SIGNATURE' | 'RESPONSE_PAYLOAD_MISSING';
+};
+//# sourceMappingURL=types.d.ts.map

package/libESM/types.js

@@ -0,0 +1 @@
+export {};

package/libESM/utils.d.ts

@@ -0,0 +1,17 @@
+import { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { DeviceAuthenticityBlacklistConfig } from './config/deviceAuthenticityBlacklistConfigTypes';
+import type { DeviceAuthenticityConfig } from './config/deviceAuthenticityConfigTypes';
+export declare const getRandomChallenge: () => Buffer<ArrayBufferLike>;
+type GetRootPubKeyBlacklistParams = {
+    blacklistConfig: DeviceAuthenticityBlacklistConfig;
+    allowDebugKeys?: boolean;
+};
+export declare const getRootPubKeyBlacklist: ({ blacklistConfig, allowDebugKeys, }: GetRootPubKeyBlacklistParams) => string[];
+type GetRootPubKeysParams = {
+    config: DeviceAuthenticityConfig;
+    deviceModel: keyof typeof PROTO.DeviceModelInternal;
+    allowDebugKeys?: boolean;
+};
+export declare const getRootPubKeys: ({ config, deviceModel, allowDebugKeys, }: GetRootPubKeysParams) => string[];
+export {};
+//# sourceMappingURL=utils.d.ts.map

package/libESM/utils.js

@@ -0,0 +1,28 @@
+import * as crypto from "crypto";
+export const getRandomChallenge = () => crypto.randomBytes(32);
+export const getRootPubKeyBlacklist = ({
+  blacklistConfig,
+  allowDebugKeys
+}) => {
+  const normalBlacklist = blacklistConfig.blacklistedCaPubKeys ?? [];
+  const debugBlacklist = blacklistConfig.debug?.blacklistedCaPubKeys ?? [];
+  return allowDebugKeys ? normalBlacklist.concat(debugBlacklist) : normalBlacklist;
+};
+export const getRootPubKeys = ({
+  config,
+  deviceModel,
+  allowDebugKeys
+}) => {
+  const modelConfig = config[deviceModel];
+  if (modelConfig === undefined) {
+    throw new Error(`Pubkeys for ${deviceModel} not found in config`);
+  }
+  const rootPubKeysNormalOptiga = modelConfig.rootPubKeysOptiga ?? [];
+  const rootPubKeysNormalTropic = modelConfig.rootPubKeysTropic ?? [];
+  const rootPubKeysDebugOptiga = modelConfig.debug?.rootPubKeysOptiga ?? [];
+  const rootPubKeysDebugTropic = modelConfig.debug?.rootPubKeysTropic ?? [];
+  const rootPubKeysNormal = [...rootPubKeysNormalOptiga, ...rootPubKeysNormalTropic];
+  if (!allowDebugKeys) return rootPubKeysNormal;
+  return [...rootPubKeysNormal, ...rootPubKeysDebugOptiga, ...rootPubKeysDebugTropic];
+};
+//# sourceMappingURL=utils.js.map

package/libESM/verifyAuthenticityProof.d.ts

@@ -0,0 +1,4 @@
+import { VerifyAuthenticityProofParams, VerifyAuthenticityProofResult, VerifySignature } from './types';
+export declare const verifySignatureP256: VerifySignature;
+export declare const verifyAuthenticityProof: ({ challenge, certificates, signature, deviceModel, allowDebugKeys, config, blacklistConfig, challengePrefix, bufferChunks, }: VerifyAuthenticityProofParams) => Promise<VerifyAuthenticityProofResult>;
+//# sourceMappingURL=verifyAuthenticityProof.d.ts.map