expo-device-crypto 0.1.0

package/.eslintrc.js

@@ -0,0 +1,5 @@
+module.exports = {
+  root: true,
+  extends: ['universe/native', 'universe/web'],
+  ignorePatterns: ['build'],
+};

package/README.md

@@ -0,0 +1,132 @@
+## `expo-device-crypto`
+
+> ⚠️ This module is currently in beta and is not suitable for production use.
+
+Hardware-backed cryptography for Expo apps using Android Keystore and Apple Secure Enclave/Keychain where available.
+
+## Installation
+
+```bash
+npx expo install expo-device-crypto
+```
+
+If you want to allow Face ID on iOS, add this to your app config:
+
+```json
+{
+  "expo": {
+    "ios": {
+      "infoPlist": {
+        "NSFaceIDUsageDescription": "We use Face ID to protect your cryptographic keys."
+      }
+    }
+  }
+}
+```
+
+## Supported Algorithms
+
+### ECDSA (`ECDSA_SECP256R1_SHA256`)
+
+- **Type:** Digital signature algorithm (asymmetric).
+- **Curve:** P-256 / secp256r1.
+- **Hash:** SHA-256.
+- **Use it for:** Authentication challenges, message signing, and tamper detection.
+
+### RSA (`RSA_2048_PKCS1`)
+
+- **Type:** Asymmetric encryption algorithm.
+- **Key size:** 2048 bits.
+- **Padding:** PKCS#1 v1.5.
+- **Use it for:** Encrypting small secrets that only the private key holder should decrypt.
+
+## Biometric and Passcode Protection
+
+You can bind private key usage to user authentication with:
+
+- `requireAuthentication: true` when creating a key pair. (set to `false` to allow signing and decryption without authentication prompts)
+- Use `AuthMethod.PASSCODE` or `AuthMethod.PASSCODE_OR_BIOMETRIC` to specify whether authentication should require only a passcode or allow biometrics when available.
+
+Before using authentication-protected keys, verify that device authentication is available. If the user has not enabled at least a passcode, this function returns `AuthCheckResult.UNAVAILABLE`.
+
+```ts
+import DeviceCrypto, { AuthCheckResult } from "expo-device-crypto";
+
+const authStatus = DeviceCrypto.isAuthCheckAvailable();
+if (authStatus !== AuthCheckResult.AVAILABLE) {
+  throw new Error(`Authentication unavailable: ${authStatus}`);
+}
+```
+
+## Example: ECDSA with Biometric
+
+```ts
+import DeviceCrypto, {
+  AuthMethod,
+  SigningAlgorithm,
+} from "expo-device-crypto";
+
+const alias = "user-signing-key";
+const payload = "Sign this challenge payload";
+const algorithmType = SigningAlgorithm.ECDSA_SECP256R1_SHA256;
+const authMethod = AuthMethod.PASSCODE_OR_BIOMETRIC;
+
+// 1) Generate an auth-protected ECDSA key pair
+await DeviceCrypto.generateKeyPair(alias, {
+  requireAuthentication: true,
+  authMethod, // iOS: defined at key generation;
+  algorithmType,
+});
+
+// 2) Optional: share public key with backend
+const publicKeyPem = DeviceCrypto.getPublicKey(alias, { format: "PEM" });
+
+// 3) Sign with private key (prompts biometric/passcode on protected keys)
+// Note: The data to sign must be in UTF-8 format.
+const signature = await DeviceCrypto.sign(alias, payload, {
+  algorithmType,
+  authMethod, // Android: defined when signing
+});
+
+// 4) Verify locally (usually done server-side with stored public key)
+const isValid = await DeviceCrypto.verify(alias, payload, signature ?? "", {
+  algorithmType,
+});
+```
+
+## Example: RSA with Biometric
+
+```ts
+import DeviceCrypto, {
+  AuthMethod,
+  EncryptionAlgorithm,
+} from "expo-device-crypto";
+
+const alias = "user-encryption-key";
+const secret = "Sensitive token";
+const algorithmType = EncryptionAlgorithm.RSA_2048_PKCS1;
+const authMethod = AuthMethod.PASSCODE_OR_BIOMETRIC;
+
+// 1) Generate an auth-protected RSA key pair
+await DeviceCrypto.generateKeyPair(alias, {
+  algorithmType,
+  requireAuthentication: true,
+  authMethod, // iOS: defined at key generation;
+});
+
+// 2) Optional: retrieve/share public key with backend
+const publicKeyPem = DeviceCrypto.getPublicKey(alias, { format: "PEM" });
+
+// 3) Encrypt with public key
+const encrypted = await DeviceCrypto.encrypt(alias, secret, {
+  algorithmType,
+});
+
+// 4) Decrypt with private key (prompts biometric/passcode on protected keys)
+// Note: Data to encrypt must be in Base64 format.
+const decrypted = await DeviceCrypto.decrypt(alias, encrypted ?? "", {
+  algorithmType,
+  authMethod, // Android: defined when decrypting
+});
+```
+

package/android/build.gradle

@@ -0,0 +1,47 @@
+apply plugin: 'com.android.library'
+
+group = 'expo.modules.devicecrypto'
+version = '0.1.0'
+
+def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
+apply from: expoModulesCorePlugin
+applyKotlinExpoModulesCorePlugin()
+useCoreDependencies()
+useExpoPublishing()
+
+// If you want to use the managed Android SDK versions from expo-modules-core, set this to true.
+// The Android SDK versions will be bumped from time to time in SDK releases and may introduce breaking changes in your module code.
+// Most of the time, you may like to manage the Android SDK versions yourself.
+def useManagedAndroidSdkVersions = false
+if (useManagedAndroidSdkVersions) {
+  useDefaultAndroidSdkVersions()
+} else {
+  buildscript {
+    // Simple helper that allows the root project to override versions declared by this library.
+    ext.safeExtGet = { prop, fallback ->
+      rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+    }
+  }
+  project.android {
+    compileSdkVersion safeExtGet("compileSdkVersion", 36)
+    defaultConfig {
+      minSdkVersion safeExtGet("minSdkVersion", 24)
+      targetSdkVersion safeExtGet("targetSdkVersion", 36)
+    }
+  }
+}
+
+android {
+  namespace "expo.modules.devicecrypto"
+  defaultConfig {
+    versionCode 1
+    versionName "0.1.0"
+  }
+  lintOptions {
+    abortOnError false
+  }
+}
+
+dependencies {
+  implementation "androidx.biometric:biometric:1.1.0"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest>
+</manifest>

package/android/src/main/java/expo/modules/devicecrypto/DeviceCryptoModule.kt

@@ -0,0 +1,385 @@
+package expo.modules.devicecrypto
+
+import android.content.pm.PackageManager
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyInfo
+import android.security.keystore.KeyProperties
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import android.util.Base64
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
+import androidx.biometric.BiometricManager.Authenticators.DEVICE_CREDENTIAL
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.FragmentActivity
+import expo.modules.kotlin.Promise
+import java.security.Signature
+import android.widget.Toast
+import android.content.Context
+import java.security.KeyFactory
+import javax.crypto.Cipher
+
+enum class GenerateKeyPairResult {
+  KEY_PAIR_GENERATED,
+  KEY_PAIR_ALREADY_EXISTS,
+  NOT_AVAILABLE,
+}
+
+enum class AuthCheckResult {
+  AVAILABLE,
+  UNAVAILABLE,
+  NO_HARDWARE,
+}
+
+enum class AuthMethod {
+  PASSCODE,
+  PASSCODE_OR_BIOMETRIC,
+}
+
+enum class AlgorithmType {
+  ECDSA_SECP256R1_SHA256,
+  RSA_2048_PKCS1,
+}
+
+class DeviceCryptoModule : Module() {
+  private fun toAndroidAlgo(algorithm: AlgorithmType): String {
+    return when (algorithm) {
+      AlgorithmType.ECDSA_SECP256R1_SHA256 -> "SHA256withECDSA"
+      AlgorithmType.RSA_2048_PKCS1 -> "RSA/ECB/PKCS1Padding"
+    }
+  }
+
+  private fun isAuthCheckAvailable(): AuthCheckResult {
+    val biometricManager = BiometricManager.from(appContext.reactContext as Context)
+    return when (biometricManager.canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)) {
+      BiometricManager.BIOMETRIC_SUCCESS -> AuthCheckResult.AVAILABLE
+      BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> AuthCheckResult.NO_HARDWARE
+      BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> AuthCheckResult.UNAVAILABLE
+      else -> AuthCheckResult.UNAVAILABLE
+    }
+  }
+
+  private fun isKeyStoreAvailable(): Boolean {
+    val pm = appContext.reactContext?.packageManager ?: return false
+    val appAttestKeystore = pm.hasSystemFeature(PackageManager.FEATURE_KEYSTORE_APP_ATTEST_KEY)
+    val hardwareKeystore = pm.hasSystemFeature(PackageManager.FEATURE_HARDWARE_KEYSTORE)
+    return appAttestKeystore && hardwareKeystore
+  }
+
+  private fun isStrongBoxAvailable(): Boolean {
+    val pm = appContext.reactContext?.packageManager ?: return false
+    val strongboxKeystore = pm.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
+    return strongboxKeystore
+  }
+
+  private fun getAliases() = KeyStore.getInstance("AndroidKeyStore").apply {
+    load(null)
+  }.aliases().toList()
+
+  private fun isKeyStoreRequireAuthentication(entry: KeyStore.PrivateKeyEntry): Boolean {
+    val keyFactory = KeyFactory.getInstance(entry.privateKey.algorithm, "AndroidKeyStore")
+    val keyInfo = keyFactory.getKeySpec(entry.privateKey, KeyInfo::class.java)
+    return keyInfo.isUserAuthenticationRequired
+  }
+
+  private fun getKeyStoreEntry(alias: String): KeyStore.Entry? {
+    return KeyStore.getInstance("AndroidKeyStore").apply {
+      load(null)
+    }.getEntry(alias, null)
+  }
+
+  private fun retrievePublicKey(ks: KeyStore.Entry?): String? {
+    if (ks !is KeyStore.PrivateKeyEntry) return null
+    
+    val publicKeyBytes: ByteArray = ks.certificate?.publicKey?.encoded ?: return null
+    return Base64.encodeToString(publicKeyBytes, Base64.NO_WRAP)
+  }
+
+  private fun removeKeyStoreEntry(alias: String): Boolean {
+    val ks = KeyStore.getInstance("AndroidKeyStore").apply {
+      load(null)
+    }
+    if (ks.getEntry(alias, null) == null) return false
+
+    ks.deleteEntry(alias)
+    return true
+  }
+
+  private fun buildECDSA_SECP256R1_SHA256(alias: String, reqAuth: Boolean): KeyPairGenerator {
+    val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
+      KeyProperties.KEY_ALGORITHM_EC,
+      "AndroidKeyStore"
+    )
+
+    val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
+      alias,
+      KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
+    ).run {
+      setDigests(KeyProperties.DIGEST_SHA256)
+      setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
+      setUserAuthenticationRequired(reqAuth)
+      if (reqAuth) {
+        setUserAuthenticationParameters(
+          30, // 30 seconds
+          KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
+        )
+      }
+      build()
+    }
+    kpg.initialize(parameterSpec)
+    return kpg
+  }
+
+  private fun buildRSA_2048_PKCS1(alias: String, reqAuth: Boolean): KeyPairGenerator {
+    val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
+      KeyProperties.KEY_ALGORITHM_RSA,
+      "AndroidKeyStore"
+    )
+
+    val parameterSpec: KeyGenParameterSpec = KeyGenParameterSpec.Builder(
+      alias,
+      KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+    ).run {
+      setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
+      setIsStrongBoxBacked(false) // TODO: Prefer strong box if available
+      setUserAuthenticationRequired(reqAuth)
+      if (reqAuth) {
+        setUserAuthenticationParameters(
+          30, // 30 seconds
+          KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
+        )
+      }
+      build()
+    }
+    kpg.initialize(parameterSpec)
+    return kpg
+  }
+
+
+  private fun showAuthPrompt(
+    onSuccess: () -> Unit,
+    onError: (String) -> Unit,
+    title: String = "Unlock",
+    subtitle: String = "Enter your PIN to continue",
+    authMethod: AuthMethod
+  ) {
+    val activity = appContext.currentActivity as? FragmentActivity ?: run {
+      onError("No active FragmentActivity found")
+      return
+    }
+
+    activity.runOnUiThread {
+      val executor = ContextCompat.getMainExecutor(activity)
+      val biometricPrompt = BiometricPrompt(
+        activity,
+        executor,
+        object : BiometricPrompt.AuthenticationCallback() {
+
+          override fun onAuthenticationSucceeded(
+            result: BiometricPrompt.AuthenticationResult
+          ) {
+            super.onAuthenticationSucceeded(result)
+            onSuccess()
+          }
+
+          override fun onAuthenticationError(
+            errorCode: Int,
+            errString: CharSequence
+          ) {
+            super.onAuthenticationError(errorCode, errString)
+            onError(errString.toString())
+          }
+        }
+      )
+
+      val promptInfo = BiometricPrompt.PromptInfo.Builder()
+        .setTitle(title)
+        .setSubtitle(subtitle)
+        .setAllowedAuthenticators(
+          when (authMethod) {
+            AuthMethod.PASSCODE -> BiometricManager.Authenticators.DEVICE_CREDENTIAL
+            AuthMethod.PASSCODE_OR_BIOMETRIC -> BiometricManager.Authenticators.BIOMETRIC_STRONG or BiometricManager.Authenticators.DEVICE_CREDENTIAL
+          }
+        )
+        .build()
+
+      biometricPrompt.authenticate(promptInfo)
+    }
+  }
+
+  override fun definition() = ModuleDefinition {
+    Name("DeviceCrypto")
+
+    Function("isAuthCheckAvailable") { ->
+      return@Function isAuthCheckAvailable()
+    }
+
+    Function("generateKeyPair") { alias: String, o: Map<String, Any?> ->
+      val reqAuth = o["reqAuth"] as Boolean
+      if (reqAuth && isAuthCheckAvailable() != AuthCheckResult.AVAILABLE) {
+        throw Exception("NO_AUTH_AVAILABLE")
+      }
+      if (!isKeyStoreAvailable()) {
+        return@Function GenerateKeyPairResult.NOT_AVAILABLE
+      }
+      if (getKeyStoreEntry(alias) != null) {
+        return@Function GenerateKeyPairResult.KEY_PAIR_ALREADY_EXISTS
+      }
+
+      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+      val kpg = when (algoType) {
+        AlgorithmType.ECDSA_SECP256R1_SHA256 -> buildECDSA_SECP256R1_SHA256(alias, reqAuth)
+        AlgorithmType.RSA_2048_PKCS1 -> buildRSA_2048_PKCS1(alias, reqAuth)
+        else -> throw Exception("INVALID_ALGORITHM_TYPE")
+      }
+
+      kpg.generateKeyPair()
+
+      return@Function GenerateKeyPairResult.KEY_PAIR_GENERATED
+    }
+
+    Function("removeKeyPair") { alias: String ->
+      return@Function removeKeyStoreEntry(alias)
+    }
+
+    Function("aliases") {
+      return@Function getAliases()
+    }
+
+    Function("getPublicKey") { alias: String ->
+      val entry = getKeyStoreEntry(alias)
+      return@Function retrievePublicKey(entry)
+    }
+
+    AsyncFunction("sign") { alias: String,
+      data: String,
+      o:  Map<String, Any?>,
+      promise: Promise ->
+      val entry = getKeyStoreEntry(alias)
+      if (entry !is KeyStore.PrivateKeyEntry) {
+        promise.resolve(null)
+        return@AsyncFunction
+      }
+
+      val reqAuth = isKeyStoreRequireAuthentication(entry);
+
+      val title = o["title"] as String
+      val subtitle = o["subtitle"] as String
+      val authMethod = AuthMethod.valueOf(o["authMethod"] as String)
+      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+      val algo = toAndroidAlgo(algoType)
+
+      if (!reqAuth) {
+        val signature: ByteArray = Signature.getInstance(algo).apply {
+          initSign(entry.privateKey)
+          update(data.toByteArray(Charsets.UTF_8))
+        }.sign()
+        promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+        return@AsyncFunction
+      } else {
+        showAuthPrompt(
+          onSuccess = {
+            val signature: ByteArray = Signature.getInstance(algo).apply {
+              initSign(entry.privateKey)
+              update(data.toByteArray(Charsets.UTF_8))
+            }.sign()
+            promise.resolve(Base64.encodeToString(signature, Base64.NO_WRAP))
+          },
+          onError = { error ->
+            promise.reject("ERR_AUTH_FAILED", error, null)
+          },
+          title = title,
+          subtitle = subtitle,
+          authMethod = authMethod
+        )
+      }
+    }
+
+    Function("verify") { alias: String, 
+      data: String, 
+      signature: String, 
+      o: Map<String, Any?> ->
+      val entry = getKeyStoreEntry(alias)
+      if (entry !is KeyStore.PrivateKeyEntry) return@Function null
+
+      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+      val algo = toAndroidAlgo(algoType)
+      
+      val valid: Boolean = Signature.getInstance(algo).apply {
+        initVerify(entry.certificate)
+        update(data.toByteArray(Charsets.UTF_8))
+      }.verify(Base64.decode(signature, Base64.NO_WRAP))
+      return@Function true
+    }
+
+
+    AsyncFunction("encrypt") { alias: String, 
+      data: String, 
+      o: Map<String, Any?>,
+      promise: Promise ->
+      val entry = getKeyStoreEntry(alias)
+      if (entry !is KeyStore.PrivateKeyEntry) {
+        promise.resolve(null)
+        return@AsyncFunction
+      }
+
+      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+      val algo = toAndroidAlgo(algoType)
+
+      val cipher = Cipher.getInstance(algo)
+      cipher.init(Cipher.ENCRYPT_MODE, entry.certificate.publicKey)
+      val encrypted: ByteArray = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
+      promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+    }
+
+    AsyncFunction("decrypt") { alias: String, 
+      data: String, 
+      o: Map<String, Any?>, 
+      promise: Promise ->
+      val entry = getKeyStoreEntry(alias)
+      if (entry !is KeyStore.PrivateKeyEntry) {
+        promise.resolve(null)
+        return@AsyncFunction
+      }
+
+      val reqAuth = isKeyStoreRequireAuthentication(entry)
+
+      val title = o["title"] as String
+      val subtitle = o["subtitle"] as String
+      val authMethod = o["authMethod"] as String
+      val algoType = AlgorithmType.valueOf(o["algoType"] as String)
+      val algo = toAndroidAlgo(algoType)
+
+      val cipher = Cipher.getInstance(algo)
+      val ciphertext = Base64.decode(data, Base64.NO_WRAP)
+
+      if (!reqAuth) {
+        cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+        val decrypted: ByteArray = cipher.doFinal(ciphertext)
+        promise.resolve(String(decrypted, Charsets.UTF_8))
+        return@AsyncFunction
+      } else {
+        showAuthPrompt(
+          onSuccess = {
+            cipher.init(Cipher.DECRYPT_MODE, entry.privateKey)
+            val decrypted: ByteArray = cipher.doFinal(ciphertext)
+            promise.resolve(String(decrypted, Charsets.UTF_8))
+          },
+          onError = { error ->
+            promise.reject("ERR_AUTH_FAILED", error, null)
+          },
+          title = title,
+          subtitle = subtitle,
+          authMethod = when (authMethod) {
+            "PASSCODE" -> AuthMethod.PASSCODE
+            "PASSCODE_OR_BIOMETRIC" -> AuthMethod.PASSCODE_OR_BIOMETRIC
+            else -> AuthMethod.PASSCODE_OR_BIOMETRIC
+          }
+        )
+      }
+    }
+  }
+}

package/build/DeviceCrypto.types.d.ts

@@ -0,0 +1,101 @@
+export declare enum GenerateKeyPairResult {
+    KEY_PAIR_GENERATED = "KEY_PAIR_GENERATED",
+    KEY_PAIR_ALREADY_EXISTS = "KEY_PAIR_ALREADY_EXISTS",
+    NOT_AVAILABLE = "NOT_AVAILABLE"
+}
+export declare enum AuthCheckResult {
+    AVAILABLE = "AVAILABLE",
+    NO_HARDWARE = "NO_HARDWARE",
+    UNAVAILABLE = "UNAVAILABLE"
+}
+export declare enum AuthMethod {
+    PASSCODE = "PASSCODE",
+    PASSCODE_OR_BIOMETRIC = "PASSCODE_OR_BIOMETRIC"
+}
+export declare enum SigningAlgorithm {
+    ECDSA_SECP256R1_SHA256 = "ECDSA_SECP256R1_SHA256"
+}
+export declare enum EncryptionAlgorithm {
+    RSA_2048_PKCS1 = "RSA_2048_PKCS1"
+}
+export interface GenerateKeyPairOptions {
+    /**
+     * The algorithm type of the key to generate.
+     */
+    algorithmType: SigningAlgorithm | EncryptionAlgorithm;
+    /**
+     * Whether to require authentication to sign.
+     * Setting this to true will prompt biometric or passcode authentication before signing.
+     *
+     * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.
+     * If authentication is not available, generating a key pair will throw an error.
+     * @default false
+     */
+    requireAuthentication?: boolean;
+    /**
+     * The method of authentication to use.
+     * Note that on Android you have to define it when signing.
+     *
+     * If you want to allow to use Face ID, you need to add the following to your app.json config file:
+     * ```json
+     * "ios": {
+     *   "infoPlist": {
+     *     "NSFaceIDUsageDescription": "We use Face ID to secure your data.",
+     *   }
+     * }
+     * ```
+     * @default AuthMethod.PASSCODE_OR_BIOMETRIC
+     * @platform ios
+     */
+    authMethod?: AuthMethod;
+}
+interface BaseSignDecryptOptions {
+    /**
+     * The title of the prompt to show when authentication is required.
+     * @default "Unlock"
+     * @platform android
+     */
+    promptTitle?: string;
+    /**
+     * The subtitle of the prompt to show when authentication is required.
+     * @default "Enter your PIN to continue"
+     * @platform android
+     */
+    promptSubtitle?: string;
+    /**
+     * The method of authentication to use.
+     * Note that on iOS you have to define it when generating the key pair.
+     * @default AuthMethod.PASSCODE_OR_BIOMETRIC
+     * @platform android
+     */
+    authMethod?: AuthMethod;
+}
+interface BaseSigningOptions {
+    /**
+     * The algorithm type of the key to use for signing.
+     */
+    algorithmType?: SigningAlgorithm;
+}
+interface BaseEncryptionOptions {
+    /**
+     * The algorithm type of the key to use for encrypting.
+     */
+    algorithmType?: EncryptionAlgorithm;
+}
+export interface SignOptions extends BaseSignDecryptOptions, BaseSigningOptions {
+}
+export interface VerifyOptions extends BaseSigningOptions {
+}
+export interface DecryptOptions extends BaseSignDecryptOptions, BaseEncryptionOptions {
+}
+export interface EncryptOptions extends BaseEncryptionOptions {
+}
+export interface GetPublicKeyOptions {
+    /**
+     * The format of the public key to return.
+     * @default "PEM" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)
+     */
+    format?: "PEM";
+}
+export {};
+//# sourceMappingURL=DeviceCrypto.types.d.ts.map

package/build/DeviceCrypto.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,sBAAsB;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,WAAY,SAAQ,sBAAsB,EAAE,kBAAkB;CAAG;AAClF,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D,MAAM,WAAW,cAAe,SAAQ,sBAAsB,EAAE,qBAAqB;CAAG;AACxF,MAAM,WAAW,cAAe,SAAQ,qBAAqB;CAAG;AAEhE,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB"}