openrtc-trust-apple-app-attest 2.0.0-rc.15

package/LICENSE

@@ -0,0 +1,3 @@
+Copyright (c) OpenRTC contributors. All rights reserved.
+
+Use is governed by the OpenRTC license distributed with this package.

package/README.md

@@ -0,0 +1,18 @@
+# openrtc-trust-apple-app-attest
+
+This package adapts an application-owned native App Attest implementation to
+OpenRTC's provider-neutral enrollment interface. The native host must return
+evidence bound to the exact challenge it receives. Encode the host result as a
+base64url JSON token. Initial enrollment uses
+`{ mode: "attestation", keyId, attestationObject }`; renewal uses
+`{ mode: "assertion", keyId, assertion }`. Binary fields are base64url.
+
+OpenRTC verifies Apple’s App Attestation root chain, certificate nonce, App ID
+RP hash, environment AAGUID, key identifier, validation category, bundle
+version, assertion signature, challenge binding, and monotonic counter. Only
+the verified public key and counter are retained; raw evidence is never stored.
+
+`AppleAppAttestProvider` declares `request-challenge` binding. The separate
+`AppleDeviceCheckProvider` is a lower-trust `app-session` fallback: DeviceCheck
+does not sign OpenRTC's enrollment challenge and must be registered separately
+in the developer manifest. Neither adapter is a connection heartbeat.

package/dist/index.d.ts

@@ -0,0 +1,35 @@
+import type { OpenRTCAttestationProvider } from 'openrtc';
+export interface AppleAppAttestHost {
+    attest(input: {
+        challenge: string;
+        apiKey: string;
+    }): Promise<{
+        token: string;
+    }>;
+}
+export declare class AppleAppAttestProvider implements OpenRTCAttestationProvider {
+    private readonly host;
+    readonly kind: "apple-app-attest";
+    readonly evidenceBinding: "request-challenge";
+    constructor(host: AppleAppAttestHost);
+    getEvidence(input: {
+        challenge: string;
+        apiKey: string;
+    }): Promise<{
+        token: string;
+    }>;
+}
+/** Explicitly lower-trust fallback; it must be registered separately in the portal. */
+export declare class AppleDeviceCheckProvider implements OpenRTCAttestationProvider {
+    private readonly host;
+    readonly kind: "custom:apple-device-check";
+    readonly evidenceBinding: "app-session";
+    constructor(host: AppleAppAttestHost);
+    getEvidence(input: {
+        challenge: string;
+        apiKey: string;
+    }): Promise<{
+        token: string;
+    }>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IAC/B,MAAM,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,qBAAa,sBAAuB,YAAW,0BAA0B;IAGzD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;IAC5C,QAAQ,CAAC,eAAe,EAAG,mBAAmB,CAAU;gBAC3B,IAAI,EAAE,kBAAkB;IAE/C,WAAW,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAK9F;AAED,uFAAuF;AACvF,qBAAa,wBAAyB,YAAW,0BAA0B;IAG3D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,QAAQ,CAAC,eAAe,EAAG,aAAa,CAAU;gBACrB,IAAI,EAAE,kBAAkB;IAE/C,WAAW,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAK9F"}

package/dist/index.js

@@ -0,0 +1,28 @@
+export class AppleAppAttestProvider {
+    constructor(host) {
+        this.host = host;
+        this.kind = 'apple-app-attest';
+        this.evidenceBinding = 'request-challenge';
+    }
+    async getEvidence(input) {
+        const evidence = await this.host.attest(input);
+        if (!evidence.token)
+            throw new Error('Apple App Attest returned empty evidence.');
+        return evidence;
+    }
+}
+/** Explicitly lower-trust fallback; it must be registered separately in the portal. */
+export class AppleDeviceCheckProvider {
+    constructor(host) {
+        this.host = host;
+        this.kind = 'custom:apple-device-check';
+        this.evidenceBinding = 'app-session';
+    }
+    async getEvidence(input) {
+        const evidence = await this.host.attest(input);
+        if (!evidence.token)
+            throw new Error('Apple DeviceCheck returned empty evidence.');
+        return evidence;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,sBAAsB;IAG/B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAF5C,SAAI,GAAG,kBAA2B,CAAC;QACnC,oBAAe,GAAG,mBAA4B,CAAC;IACA,CAAC;IAEzD,KAAK,CAAC,WAAW,CAAC,KAA4C;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AAED,uFAAuF;AACvF,MAAM,OAAO,wBAAwB;IAGjC,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAF5C,SAAI,GAAG,2BAAoC,CAAC;QAC5C,oBAAe,GAAG,aAAsB,CAAC;IACM,CAAC;IAEzD,KAAK,CAAC,WAAW,CAAC,KAA4C;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACnF,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ"}

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "openrtc-trust-apple-app-attest",
+  "version": "2.0.0-rc.15",
+  "private": false,
+  "type": "module",
+  "sideEffects": false,
+  "description": "Optional Apple App Attest host adapter for OpenRTC 2.0 device enrollment.",
+  "license": "SEE LICENSE IN LICENSE",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": ["dist", "LICENSE", "README.md"],
+  "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }, "./package.json": "./package.json" },
+  "scripts": { "build": "rm -rf dist && tsc", "test": "vitest run", "test:deterministic": "vitest run", "prepublishOnly": "pnpm run build && pnpm run test" },
+  "peerDependencies": { "openrtc": "2.0.0-rc.15" },
+  "devDependencies": { "openrtc": "workspace:*", "typescript": "^5.8.3", "vitest": "^4.0.18" }
+}