node-tpm2 0.0.4-beta.4 → 0.0.5-beta.1

package/docs/roadmap.md

@@ -9,25 +9,23 @@ or depends on downstream products.
 
 ---
 
-## Current state (0.0.4-beta)
+## Current state (0.0.5-beta)
 
-**Shipped**
+**Shipped and validated on real Windows 11 hardware (Intel TPM, non-virtual):** attestation (user + machine provision, cross-user quote, SYSTEM provision), `random`, `keys` (sign + RSA decrypt), `pcr.read` / `pcr.extend` (admin on Windows), `nv` (read/write/define/undefine/readPublic), `seal` / `unseal`.
 
 | Namespace | Methods |
 |-----------|---------|
-| Root | `Tpm.isAvailable()`, `Tpm.open()`, `Tpm.info()` |
+| Root | `Tpm.isAvailable()`, `Tpm.open()`, `Tpm.info()`, `tpm.readPublic()` |
+| `tpm.random` | `bytes(n)` |
 | `tpm.pcr` | `read`, `extend` |
+| `tpm.nv` | `read`, `write`, `readPublic`, `define`, `undefine` |
+| `tpm.keys` | `create`, `load`; `KeyHandle.sign`, `export`, `decrypt` |
+| `tpm.seal` | `seal`, `unseal` |
 | `tpm.attest` | `provisionAk`, `quote`, `ekCertificate` |
 | `AkHandle` | `export`, `quote`, `activateCredential`, `publicKeyDer` |
-| Flat | `Tpm.pcrRead`, `Tpm.pcrExtend`, `readPublic`, `readEkCertificate`, `quote`, `provisionAk`, `activateCredential` |
+| Flat | Parity wrappers for all of the above (`Tpm.pcrRead`, `Tpm.nvDefine`, `Tpm.seal`, …) |
 
-**Rust foundation already present (not exposed on `TpmHandle` yet):**
-
-- Command codec: `CreatePrimary`, `Create`, `Load`, `FlushContext`, `Quote`, `GetRandom`, sessions, policy digest
-- Linux key path: `keys.rs` (storage primary, AK create/load)
-- Windows PCP path: `pcp.rs` (identity AK, machine DACL, quote, activation)
-- NV: EK certificate read via fixed index
-- Credential: full activate-credential flow (Linux TBS; Windows PCP)
+**Platform split:** General ops (keys, seal, NV, PCR, random) use TBS on both OSes. Attestation persistence on Windows uses NCrypt PCP (`PCP1` / `PCP2` blobs); Linux uses TBS-wrapped ECDSA AK blobs.
 
 ---
 
@@ -121,13 +119,13 @@ Flat equivalents remain on `Tpm.*` for every operation (thin wrappers over the s
 - [x] JS: `tpm.random.bytes(n)`, `Tpm.randomBytes(n)`
 - [ ] Tests: integration on Linux + Windows VM
 
-### Phase 2 — `tpm.keys` ✅ (this branch; decrypt deferred)
+### Phase 2 — `tpm.keys` ✅
 
 **Goal:** General exportable signing keys via TBS wrapped blobs (both OSes).
 
 - [x] `keys.create` / `keys.load` / `key.sign` — ECC + RSA sign keys
 - [x] Unit tests: templates, Sign command golden, option validation, HW roundtrip
-- [ ] `key.decrypt` — RSA OAEP (deferred)
+- [x] `key.decrypt` — RSA OAEP
 - [ ] Windows VM sign smoke
 
 ### Phase 3 — `tpm.pcr.extend` ✅ (this branch)
@@ -138,32 +136,30 @@ Flat equivalents remain on `Tpm.*` for every operation (thin wrappers over the s
 - [x] JS: `tpm.pcr.extend(index, digest)`.
 - [x] Tests: extend → read → digest changed.
 - [x] Caveats: some firmware policies lock PCRs; surface `TPM_RC` / `COMMAND_BLOCKED` cleanly.
-- [ ] Acceptance: works unprivileged on swtpm and dev VM where PCRs are extendable.
+- [x] Acceptance: Linux unprivileged on swtpm/dev VM; **Windows Administrator** on real client hardware (PCR 23 validated).
 
-### Phase 4 — `tpm.nv` (1 week)
+### Phase 4 — `tpm.nv` ✅ (this branch)
 
 **Goal:** General NV index access beyond EK cert helper.
 
-- Rust:
-  - `nv.read_public(handle)` — already partially in `nv.rs`; expose metadata (size, attributes).
-  - `nv.read(handle, offset, size)`.
-  - `nv.write(handle, offset, data, auth?)` — auth optional buffer for password/session auth.
-  - `nv.define` / `nv.undefine` — **defer** unless needed (owner-auth, high privilege).
-- Migrate `readEkCertificate` to call `nv.read` on well-known EK cert index internally.
-- JS: `tpm.nv.read`, `tpm.nv.write`; document which indices are safe on consumer hardware.
-- Acceptance: EK cert read unchanged; optional integration test against swtpm-defined NV index.
+- [x] Rust: `nv.read_public(handle)` — size + attributes via `nv_read_public`.
+- [x] `nv.read(handle, offset, size)`.
+- [x] `nv.write(handle, offset, data, auth?)` — optional auth for password-protected indices.
+- [x] `nv.define` / `nv.undefine` — owner-auth; owner NV range only; refuses EK indices.
+- [x] Migrate `readEkCertificate` to call `nv.read` on well-known EK cert index internally.
+- [x] JS: `tpm.nv.read`, `tpm.nv.write`, `tpm.nv.readPublic`, `tpm.nv.define`, `tpm.nv.undefine`; document which indices are safe on consumer hardware.
+- [ ] Acceptance: EK cert read unchanged; optional integration test against swtpm-defined NV index (hardware: use `examples/nv-smoke.mjs` on test machine).
 
-### Phase 5 — `tpm.seal` / `tpm.unseal` (1–2 weeks)
+### Phase 5 — `tpm.seal` / `tpm.unseal` ✅ (this branch)
 
 **Goal:** TPM-bound secrets with optional PCR policy.
 
-- Rust:
-  - `seal({ data, pcrSelection?, name? })` — create storage primary or use fixed template, `Create` sealed object, export blob.
-  - `unseal(blob)` — load + `Unseal`.
-  - PCR policy: `PolicyPCR` session when `pcrSelection` provided.
-- JS: `tpm.seal`, `tpm.unseal`; flat aliases.
-- Tests: roundtrip without PCR; roundtrip with PCR extend before unseal; negative test wrong PCR.
-- Acceptance: Linux + Windows TBS; document that PCR-bound seal requires extend permission on chosen indices.
+- [x] Rust: `seal({ data, pcrSelection? })` — storage primary, `Create` sealed object, export blob.
+- [x] `unseal(blob)` — load + `Unseal`.
+- [x] PCR policy: `PolicyPCR` session when `pcrSelection` provided.
+- [x] JS: `tpm.seal`, `tpm.unseal`; flat aliases.
+- [x] Tests: roundtrip without PCR; unit tests for marshalling.
+- [ ] Acceptance: Linux + Windows TBS; roundtrip with PCR extend before unseal on hardware.
 
 ### Phase 6 — Hardening & 1.0 (ongoing)
 
@@ -216,5 +212,5 @@ Phases 1 and 3 can run in parallel after Phase 0. Phase 2 blocks Phase 5. Phase
 
 ## Versioning
 
-- Implement phases on `dev`; beta publish after each phase or logical group (e.g. beta.4 = random + keys).
+- Implement phases on `dev`; beta publish after each phase or logical group (e.g. **0.0.5-beta.0** = full NV + seal + keys decrypt).
 - `1.0.0` when Phases 0–5 acceptance criteria pass on real hardware and API surface in README matches implementation.

package/docs/windows-pcp.md

@@ -7,6 +7,7 @@ On Windows, node-tpm2 uses the **Microsoft Platform Crypto Provider** for attest
 | Operation | Standard user | Elevated admin | SYSTEM |
 |-----------|---------------|----------------|--------|
 | `Tpm.isAvailable()`, PCR read, `readPublic` | Yes | Yes | Yes |
+| `tpm.pcr.extend` | No (`REQUIRES_ELEVATION`) | Yes † | Yes † |
 | `provisionAk()` user scope (`PCP1`) | Yes | Yes | Yes |
 | `quote()` | Yes | Yes | Yes |
 | `provisionAk({ scope: 'machine' })` (`PCP2`) | No | Yes | Yes (production enroll) |
@@ -14,6 +15,8 @@ On Windows, node-tpm2 uses the **Microsoft Platform Crypto Provider** for attest
 
 **Runtime apps** typically only need `quote()` with a blob/locator from enrollment. Activation is an enrollment-time proof-of-possession step.
 
+**† `pcr.extend`:** Prefer PCR indices **16–23** (not **0–7**, which are boot/Secure Boot measurements). Standard users receive **`REQUIRES_ELEVATION`** (`hresult` `0x80280400`); **Administrator** can extend (validated on real Intel laptop). Linux standard user can extend unless firmware locks the index.
+
 ## AK blob formats
 
 | Magic | Scope | Meaning |

package/examples/nv-smoke.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * NV define / read / write / undefine cycle (owner NV index).
+ *
+ * WARNING: Mutates TPM NV storage. Use only on a test machine.
+ * Requires owner authorization (often empty password on consumer TPMs).
+ * Windows: run elevated (Admin); standard user gets REQUIRES_ELEVATION.
+ *
+ * Usage:
+ *   node nv-smoke.mjs
+ *   node nv-smoke.mjs --handle 0x01800042 --size 64
+ *
+ * Install:
+ *   npm install node-tpm2@beta
+ *   node node_modules/node-tpm2/examples/nv-smoke.mjs
+ */
+
+import { Tpm } from '../index.js';
+
+function flagValue(args, name) {
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === name && args[i + 1]) return args[++i];
+    const prefix = `${name}=`;
+    if (args[i]?.startsWith(prefix)) return args[i].slice(prefix.length);
+  }
+  return undefined;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const handle = flagValue(args, '--handle') ?? '0x01800042';
+  const size = Number(flagValue(args, '--size') ?? '64');
+
+  if (!(await Tpm.isAvailable())) {
+    console.error('FAIL: no TPM');
+    process.exit(1);
+  }
+
+  await using tpm = await Tpm.open();
+  const payload = Buffer.from(`node-tpm2-nv-smoke-${Date.now()}`);
+
+  console.log(`== nv-smoke handle=${handle} size=${size} ==`);
+
+  try {
+    await tpm.nv.undefine(handle);
+    console.log('  (pre-clean undefine OK)');
+  } catch {
+    console.log('  (pre-clean undefine skipped — index may not exist)');
+  }
+
+  await tpm.nv.define({ handle, size });
+  console.log('PASS  nv.define');
+
+  try {
+    const meta = await tpm.nv.readPublic(handle);
+    console.log('PASS  nv.readPublic', meta);
+  } catch (err) {
+    // Windows raw TBS often blocks NV_ReadPublic for owner-range indices (~0xA6);
+    // read/write still work via owner auth fallback in the native layer.
+    console.log(
+      '  (nv.readPublic skipped:',
+      err.code ?? err.message,
+      '— continuing with define size)',
+    );
+  }
+
+  await tpm.nv.write(handle, payload, 0);
+  console.log('PASS  nv.write', payload.length, 'bytes');
+
+  const readBack = await tpm.nv.read(handle, 0, payload.length);
+  if (!readBack.equals(payload)) {
+    console.error('FAIL: read mismatch');
+    process.exit(1);
+  }
+  console.log('PASS  nv.read roundtrip');
+
+  await tpm.nv.undefine(handle);
+  console.log('PASS  nv.undefine');
+
+  console.log('\nnv-smoke: OK');
+}
+
+main().catch((err) => {
+  console.error('FAIL:', err.message ?? err);
+  if (err.code) console.error('  code:', err.code);
+  if (err.tpmRc != null) console.error('  tpmRc:', err.tpmRc);
+  if (err.hresult != null) console.error('  hresult:', err.hresult);
+  process.exit(1);
+});

package/index.d.ts

@@ -84,12 +84,27 @@ export declare type KeyCreateOptions = {
   decrypt?: boolean;
 };
 
-/** @throws {TpmError} NOT_SUPPORTED until Phase 5 */
+/** Sealed blob options. */
 export declare type SealOptions = {
   data: Buffer;
   pcrSelection?: number[];
 };
 
+/** Owner NV index definition (requires owner authorization). */
+export declare type NvDefineOptions = {
+  handle: string | number;
+  size: number;
+  /** Index password when attributes use AUTHREAD/AUTHWRITE. */
+  auth?: Buffer;
+  /** Owner hierarchy password (often empty on consumer TPMs). */
+  ownerAuth?: Buffer;
+};
+
+export declare type NvReadPublicResult = {
+  dataSize: number;
+  attributes: number;
+};
+
 export declare interface AkHandle {
   export(): AkBlob;
   readonly publicKeyDer: Buffer;
@@ -97,7 +112,7 @@ export declare interface AkHandle {
   activateCredential(opts: ActivateCredentialOptions): Promise<Buffer>;
 }
 
-/** @throws {TpmError} NOT_SUPPORTED until RSA decrypt is implemented */
+/** @throws {TpmError} when key lacks decrypt attribute */
 export declare interface KeyHandle {
   export(): KeyBlob;
   sign(digest: Buffer): Promise<Buffer>;
@@ -121,19 +136,28 @@ export declare interface TpmHandle {
     bytes(count: number): Promise<Buffer>;
   };
   nv: {
-    /** @throws {TpmError} NOT_SUPPORTED until Phase 4 */
-    read(handle: string, offset?: number, size?: number): Promise<Buffer>;
-    /** @throws {TpmError} NOT_SUPPORTED until Phase 4 */
-    write(handle: string, data: Buffer, offset?: number): Promise<void>;
+    readPublic(handle: string | number): Promise<NvReadPublicResult>;
+    read(
+      handle: string | number,
+      offset?: number,
+      size?: number,
+      auth?: Buffer,
+    ): Promise<Buffer>;
+    write(
+      handle: string | number,
+      data: Buffer,
+      offset?: number,
+      auth?: Buffer,
+    ): Promise<void>;
+    define(opts: NvDefineOptions): Promise<void>;
+    undefine(handle: string | number, ownerAuth?: Buffer): Promise<void>;
   };
   keys: {
     create(opts: KeyCreateOptions): Promise<KeyHandle>;
     load(blob: KeyBlob): Promise<KeyHandle>;
   };
   seal: {
-    /** @throws {TpmError} NOT_SUPPORTED until Phase 5 */
     seal(opts: SealOptions): Promise<Buffer>;
-    /** @throws {TpmError} NOT_SUPPORTED until Phase 5 */
     unseal(blob: Buffer): Promise<Buffer>;
   };
   attest: {
@@ -160,4 +184,22 @@ export declare const Tpm: {
   activateCredential(opts: ActivateCredentialFlatOptions): Promise<Buffer>;
   createKey(opts?: KeyCreateOptions): Promise<{ publicKeyDer: Buffer; keyBlob: KeyBlob }>;
   signKeyBlob(opts: { keyBlob: KeyBlob; digest: Buffer }): Promise<Buffer>;
+  decryptKeyBlob(opts: { keyBlob: KeyBlob; cipher: Buffer }): Promise<Buffer>;
+  nvRead(
+    handle: string | number,
+    offset?: number,
+    size?: number,
+    auth?: Buffer,
+  ): Promise<Buffer>;
+  nvWrite(
+    handle: string | number,
+    data: Buffer,
+    offset?: number,
+    auth?: Buffer,
+  ): Promise<void>;
+  nvReadPublic(handle: string | number): Promise<NvReadPublicResult>;
+  nvDefine(opts: NvDefineOptions): Promise<void>;
+  nvUndefine(handle: string | number, ownerAuth?: Buffer): Promise<void>;
+  seal(opts: SealOptions): Promise<Buffer>;
+  unseal(blob: Buffer): Promise<Buffer>;
 };

package/native.cjs

@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-android-arm64')
         const bindingPackageVersion = require('node-tpm2-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-android-arm-eabi')
         const bindingPackageVersion = require('node-tpm2-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-win32-x64-gnu')
         const bindingPackageVersion = require('node-tpm2-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-windows-x64-msvc')
         const bindingPackageVersion = require('node-tpm2-windows-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-win32-ia32-msvc')
         const bindingPackageVersion = require('node-tpm2-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-windows-arm64-msvc')
         const bindingPackageVersion = require('node-tpm2-windows-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('node-tpm2-darwin-universal')
       const bindingPackageVersion = require('node-tpm2-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-darwin-x64')
         const bindingPackageVersion = require('node-tpm2-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-darwin-arm64')
         const bindingPackageVersion = require('node-tpm2-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-freebsd-x64')
         const bindingPackageVersion = require('node-tpm2-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-freebsd-arm64')
         const bindingPackageVersion = require('node-tpm2-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-x64-musl')
           const bindingPackageVersion = require('node-tpm2-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-x64-gnu')
           const bindingPackageVersion = require('node-tpm2-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-arm64-musl')
           const bindingPackageVersion = require('node-tpm2-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-arm64-gnu')
           const bindingPackageVersion = require('node-tpm2-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-arm-musleabihf')
           const bindingPackageVersion = require('node-tpm2-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-arm-gnueabihf')
           const bindingPackageVersion = require('node-tpm2-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-loong64-musl')
           const bindingPackageVersion = require('node-tpm2-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-loong64-gnu')
           const bindingPackageVersion = require('node-tpm2-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-riscv64-musl')
           const bindingPackageVersion = require('node-tpm2-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('node-tpm2-linux-riscv64-gnu')
           const bindingPackageVersion = require('node-tpm2-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-linux-ppc64-gnu')
         const bindingPackageVersion = require('node-tpm2-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-linux-s390x-gnu')
         const bindingPackageVersion = require('node-tpm2-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-openharmony-arm64')
         const bindingPackageVersion = require('node-tpm2-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-openharmony-x64')
         const bindingPackageVersion = require('node-tpm2-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('node-tpm2-openharmony-arm')
         const bindingPackageVersion = require('node-tpm2-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.0.4-beta.4' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.0.4-beta.4 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.0.5-beta.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.5-beta.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -589,9 +589,15 @@ if (!nativeBinding) {
 module.exports = nativeBinding
 module.exports.activateCredential = nativeBinding.activateCredential
 module.exports.createKey = nativeBinding.createKey
+module.exports.decryptKeyBlob = nativeBinding.decryptKeyBlob
 module.exports.getFixedProperties = nativeBinding.getFixedProperties
 module.exports.isAvailable = nativeBinding.isAvailable
 module.exports.keyBlobPublicDer = nativeBinding.keyBlobPublicDer
+module.exports.nvDefine = nativeBinding.nvDefine
+module.exports.nvRead = nativeBinding.nvRead
+module.exports.nvReadPublic = nativeBinding.nvReadPublic
+module.exports.nvUndefine = nativeBinding.nvUndefine
+module.exports.nvWrite = nativeBinding.nvWrite
 module.exports.pcrExtend = nativeBinding.pcrExtend
 module.exports.pcrRead = nativeBinding.pcrRead
 module.exports.provisionAk = nativeBinding.provisionAk
@@ -599,4 +605,6 @@ module.exports.quote = nativeBinding.quote
 module.exports.randomBytes = nativeBinding.randomBytes
 module.exports.readEkCertificate = nativeBinding.readEkCertificate
 module.exports.readPublic = nativeBinding.readPublic
+module.exports.seal = nativeBinding.seal
 module.exports.signKeyBlob = nativeBinding.signKeyBlob
+module.exports.unseal = nativeBinding.unseal