react-native-dpop 0.4.0 → 1.0.0

package/README.md

@@ -35,16 +35,17 @@ cd ios && pod install
 ```ts
 import { DPoP } from 'react-native-dpop';
 
-const dpop = await DPoP.generateProof({
+const dPoP = await DPoP.generateProof({
   htu: 'https://api.example.com/token',
   htm: 'POST',
   accessToken: 'ACCESS_TOKEN',
   nonce: 'SERVER_NONCE',
+  requireHardwareBacked: true,
 });
 
-const proof = dpop.proof;
-const thumbprint = await dpop.calculateThumbprint();
-const publicJwk = await dpop.getPublicKey('JWK');
+const proof = dPoP.proof;
+const thumbprint = await dPoP.getPublicKeyThumbprint();
+const publicJwk = await dPoP.getPublicKey('JWK');
 const keyInfo = await DPoP.getKeyInfo();
 ```
 
@@ -53,6 +54,7 @@ const keyInfo = await DPoP.getKeyInfo();
 ### Static methods
 
 - `DPoP.generateProof(input): Promise<DPoP>`
+- `DPoP.buildDPoPHeaders(input): Promise<DPoPHeaders>`
 - `DPoP.assertHardwareBacked(alias?): Promise<void>`
 - `DPoP.deleteKeyPair(alias?): Promise<void>`
 - `DPoP.getKeyInfo(alias?): Promise<DPoPKeyInfo>`
@@ -64,14 +66,32 @@ const keyInfo = await DPoP.getKeyInfo();
 - `proof: string`
 - `proofContext: DPoPProofContext`
 - `alias?: string`
-- `calculateThumbprint(): Promise<string>`
 - `getPublicKey(format): Promise<PublicJwk | string>`
-- `signWithDpopPrivateKey(payload): Promise<string>`
+- `getPublicKeyThumbprint(): Promise<string>`
+- `signWithDPoPPrivateKey(payload): Promise<string>`
 - `isBoundToAlias(alias?): Promise<boolean>`
 
+### `signWithDPoPPrivateKey()`
+
+`signWithDPoPPrivateKey()` reuses the same private key pair managed by the DPoP alias. It does not create or use a separate signing key.
+
+This means:
+
+- the signature is produced with the same key material used for DPoP proofs
+- the active alias determines which private key is used
+- if the alias points to a hardware-backed key, the same hardware-backed key is reused
+- if the alias points to a fallback software-backed key, the same fallback key is reused
+
+Recommended usage:
+
+- use this only when you intentionally want to sign arbitrary payloads with the same DPoP key
+- avoid treating it as a general-purpose application signing API
+- if you need a different trust boundary or lifecycle, use a different alias or a different key management flow
+
 ### Main types
 
 - `GenerateProofInput`
+- `DPoPHeaders`
 - `DPoPProofContext`
 - `DPoPKeyInfo`
 - `PublicJwk`
@@ -130,12 +150,32 @@ type DPoPKeyInfo = {
 - Fallback reasons are sanitized enums rather than raw native errors
 - On iOS Simulator, `secureEnclaveFallbackReason` is expected to be `UNAVAILABLE`
 
+## `buildDPoPHeaders()`
+
+`buildDPoPHeaders()` generates a proof and returns request headers ready to use.
+
+```ts
+const headers = await DPoP.buildDPoPHeaders({
+  htu: 'https://api.example.com/token',
+  htm: 'POST',
+  accessToken: 'ACCESS_TOKEN',
+});
+
+// {
+//   DPoP: '<proof>',
+//   Authorization: 'DPoP ACCESS_TOKEN',
+// }
+```
+
+If `accessToken` is omitted, only the `DPoP` header is returned.
+
 ## Notes
 
 - Default alias: `react-native-dpop`
 - `htm` is normalized to uppercase
 - `ath` is derived from `accessToken` when provided
 - `jti` and `iat` are auto-generated when omitted
+- `requireHardwareBacked` forces proof generation to fail instead of silently persisting a software-backed fallback key
 - For React Native 0.75 on Android, the library ensures `iat` is sent as a number to avoid an older bridge nullability issue with `Double`
 
 ## Example apps

package/android/src/main/java/com/reactnativedpop/DPoPKeyStore.kt

@@ -113,6 +113,8 @@ internal class DPoPKeyStore(private val context: Context) {
     val keyPair = getKeyPair(alias)
     val keyFactory = KeyFactory.getInstance(keyPair.privateKey.algorithm, KEYSTORE_PROVIDER)
     val keyInfo = keyFactory.getKeySpec(keyPair.privateKey, KeyInfo::class.java)
+    val strongBoxAvailable = isStrongBoxEnabled()
+    val strongBoxBacked = strongBoxAvailable && readStrongBoxBacked(keyInfo)
 
     return KeyStoreKeyInfo(
       alias = alias,
@@ -120,9 +122,9 @@ internal class DPoPKeyStore(private val context: Context) {
       curve = "P-256",
       insideSecureHardware = keyInfo.isInsideSecureHardware,
       securityLevel = readSecurityLevel(keyInfo),
-      securityLevelName = readSecurityLevelName(keyInfo),
-      strongBoxAvailable = isStrongBoxEnabled(),
-      strongBoxBacked = readStrongBoxBacked(keyInfo)
+      securityLevelName = readSecurityLevelName(keyInfo, strongBoxBacked),
+      strongBoxAvailable = strongBoxAvailable,
+      strongBoxBacked = strongBoxBacked
     )
   }
 
@@ -174,8 +176,7 @@ internal class DPoPKeyStore(private val context: Context) {
     }
   }
 
-  private fun readSecurityLevelName(keyInfo: KeyInfo): String {
-    val strongBoxBacked = readStrongBoxBacked(keyInfo)
+  private fun readSecurityLevelName(keyInfo: KeyInfo, strongBoxBacked: Boolean): String {
     val securityLevel = readSecurityLevel(keyInfo)
 
     return when (securityLevel) {

package/android/src/main/java/com/reactnativedpop/DPoPModule.kt

@@ -16,12 +16,29 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     private const val DEFAULT_ALIAS = "react-native-dpop"
     const val NAME = NativeReactNativeDPoPSpec.NAME
     private const val UNKNOWN_STRONGBOX_FALLBACK_REASON = "UNKNOWN"
+    private val RESERVED_DPOP_CLAIMS = setOf("ath", "htm", "htu", "iat", "jti", "nonce")
   }
 
   private fun resolveAlias(alias: String?): String {
     return alias ?: DEFAULT_ALIAS
   }
 
+  private fun ensureKeyPair(alias: String, requireHardwareBacked: Boolean): Unit {
+    var generatedInThisCall = false
+
+    if (!keyStore.hasKeyPair(alias)) {
+      keyStore.generateKeyPair(alias)
+      generatedInThisCall = true
+    }
+
+    if (requireHardwareBacked && !keyStore.isHardwareBacked(alias)) {
+      if (generatedInThisCall) {
+        keyStore.deleteKeyPair(alias)
+      }
+      throw IllegalStateException("Hardware-backed key required for alias: $alias")
+    }
+  }
+
   private fun resolveStrongBoxFallbackReason(
     strongBoxAvailable: Boolean,
     strongBoxBacked: Boolean,
@@ -57,27 +74,6 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  override fun calculateThumbprint(alias: String?, promise: Promise) {
-    try {
-      val effectiveAlias = resolveAlias(alias)
-      if (!keyStore.hasKeyPair(effectiveAlias)) {
-        keyStore.generateKeyPair(effectiveAlias)
-      }
-
-      val keyPair = keyStore.getKeyPair(effectiveAlias)
-      val coordinates = DPoPUtils.getPublicCoordinates(keyPair.publicKey)
-      val thumbprint = DPoPUtils.calculateThumbprint(
-        kty = "EC",
-        crv = "P-256",
-        x = coordinates.first,
-        y = coordinates.second
-      )
-      promise.resolve(thumbprint)
-    } catch (e: Exception) {
-      promise.reject("ERR_DPOP_CALCULATE_THUMBPRINT", e.message, e)
-    }
-  }
-
   override fun deleteKeyPair(alias: String?, promise: Promise) {
     try {
       val effectiveAlias = resolveAlias(alias)
@@ -205,6 +201,27 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     }
   }
 
+  override fun getPublicKeyThumbprint(alias: String?, promise: Promise) {
+    try {
+      val effectiveAlias = resolveAlias(alias)
+      if (!keyStore.hasKeyPair(effectiveAlias)) {
+        keyStore.generateKeyPair(effectiveAlias)
+      }
+
+      val keyPair = keyStore.getKeyPair(effectiveAlias)
+      val coordinates = DPoPUtils.getPublicCoordinates(keyPair.publicKey)
+      val thumbprint = DPoPUtils.getPublicKeyThumbprint(
+        kty = "EC",
+        crv = "P-256",
+        x = coordinates.first,
+        y = coordinates.second
+      )
+      promise.resolve(thumbprint)
+    } catch (e: Exception) {
+      promise.reject("ERR_DPOP_CALCULATE_THUMBPRINT", e.message, e)
+    }
+  }
+
   override fun hasKeyPair(alias: String?, promise: Promise) {
     try {
       val effectiveAlias = resolveAlias(alias)
@@ -238,7 +255,7 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  override fun signWithDpopPrivateKey(payload: String, alias: String?, promise: Promise) {
+  override fun signWithDPoPPrivateKey(payload: String, alias: String?, promise: Promise) {
     try {
       val effectiveAlias = resolveAlias(alias)
       if (!keyStore.hasKeyPair(effectiveAlias)) {
@@ -267,13 +284,12 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     jti: String?,
     iat: Double?,
     alias: String?,
+    requireHardwareBacked: Boolean,
     promise: Promise
   ) {
     try {
       val effectiveAlias = resolveAlias(alias)
-      if (!keyStore.hasKeyPair(effectiveAlias)) {
-        keyStore.generateKeyPair(effectiveAlias)
-      }
+      ensureKeyPair(effectiveAlias, requireHardwareBacked)
 
       val keyPair = keyStore.getKeyPair(effectiveAlias)
       val coordinates = DPoPUtils.getPublicCoordinates(keyPair.publicKey)
@@ -313,6 +329,9 @@ class DPoPModule(reactContext: ReactApplicationContext) :
         val keys = additionalJson.keys()
         while (keys.hasNext()) {
           val key = keys.next()
+          if (RESERVED_DPOP_CLAIMS.contains(key)) {
+            throw IllegalArgumentException("additional must not override reserved DPoP claim: $key")
+          }
           payload.put(key, additionalJson.get(key))
         }
       }

package/android/src/main/java/com/reactnativedpop/DPoPUtils.kt

@@ -18,12 +18,6 @@ internal object DPoPUtils {
     return Base64.getUrlEncoder().withoutPadding().encodeToString(input)
   }
 
-  internal fun calculateThumbprint(kty: String, crv: String, x: String, y: String): String {
-    val canonicalJwk = """{"crv":"$crv","kty":"$kty","x":"$x","y":"$y"}"""
-    val hash = MessageDigest.getInstance("SHA-256").digest(canonicalJwk.toByteArray(Charsets.UTF_8))
-    return base64UrlEncode(hash)
-  }
-
   internal fun derToJose(derSignature: ByteArray, partLength: Int = 32): ByteArray {
     if (derSignature.isEmpty() || derSignature[0].toInt() != 0x30) {
       throw IllegalArgumentException("Invalid DER signature format")
@@ -65,6 +59,12 @@ internal object DPoPUtils {
     return Pair(x, y)
   }
 
+  internal fun getPublicKeyThumbprint(kty: String, crv: String, x: String, y: String): String {
+    val canonicalJwk = """{"crv":"$crv","kty":"$kty","x":"$x","y":"$y"}"""
+    val hash = MessageDigest.getInstance("SHA-256").digest(canonicalJwk.toByteArray(Charsets.UTF_8))
+    return base64UrlEncode(hash)
+  }
+
   internal fun hashAccessToken(accessToken: String): String {
     val hash = MessageDigest.getInstance("SHA-256").digest(accessToken.toByteArray(Charsets.UTF_8))
     return base64UrlEncode(hash)

package/ios/DPoPKeyStore.swift

@@ -93,7 +93,7 @@ final class DPoPKeyStore {
   }
 
   func isHardwareBacked(alias: String) -> Bool {
-    secureEnclave.isHardwareBacked(alias: alias)
+    secureEnclaveAvailable && secureEnclave.isHardwareBacked(alias: alias)
   }
 
   func isSecureEnclaveAvailable() -> Bool {

package/ios/DPoPModule.swift

@@ -7,6 +7,7 @@ final class DPoPModule {
 
   private let keyStore = DPoPKeyStore()
   private let defaultAlias = "react-native-dpop"
+  private let reservedDPoPClaims = Set(["ath", "htm", "htu", "iat", "jti", "nonce"])
   private let unknownSecureEnclaveFallbackReason = "UNKNOWN"
   private let unavailableSecureEnclaveFallbackReason = "UNAVAILABLE"
 
@@ -19,6 +20,24 @@ final class DPoPModule {
     return alias
   }
 
+  func ensureKeyPair(alias: String, requireHardwareBacked: Bool) throws {
+    var generatedInThisCall = false
+
+    if !keyStore.hasKeyPair(alias: alias) {
+      try keyStore.generateKeyPair(alias: alias)
+      generatedInThisCall = true
+    }
+
+    let isHardwareBacked = keyStore.isHardwareBacked(alias: alias)
+
+    if requireHardwareBacked && !isHardwareBacked {
+      if generatedInThisCall {
+        try? keyStore.deleteKeyPair(alias: alias)
+      }
+      throw DPoPError.notHardwareBacked(alias: alias)
+    }
+  }
+
   func assertHardwareBacked(alias: String?) throws {
     let effectiveAlias = resolveAlias(alias)
     guard keyStore.hasKeyPair(alias: effectiveAlias) else {
@@ -30,16 +49,6 @@ final class DPoPModule {
     }
   }
 
-  func calculateThumbprint(alias: String?) throws -> String {
-    let effectiveAlias = resolveAlias(alias)
-    if !keyStore.hasKeyPair(alias: effectiveAlias) {
-      try keyStore.generateKeyPair(alias: effectiveAlias)
-    }
-    let keyPair = try keyStore.getKeyPair(alias: effectiveAlias)
-    let coordinates = try DPoPUtils.getPublicCoordinates(fromRawPublicKey: try DPoPUtils.toRawPublicKey(keyPair.publicKey))
-    return DPoPUtils.calculateThumbprint(kty: "EC", crv: "P-256", x: coordinates.x, y: coordinates.y)
-  }
-
   func deleteKeyPair(alias: String?) throws {
     try keyStore.deleteKeyPair(alias: resolveAlias(alias))
   }
@@ -148,6 +157,16 @@ final class DPoPModule {
     return DPoPUtils.base64UrlEncode(try DPoPUtils.toRawPublicKey(keyPair.publicKey))
   }
 
+  func getPublicKeyThumbprint(alias: String?) throws -> String {
+    let effectiveAlias = resolveAlias(alias)
+    if !keyStore.hasKeyPair(alias: effectiveAlias) {
+      try keyStore.generateKeyPair(alias: effectiveAlias)
+    }
+    let keyPair = try keyStore.getKeyPair(alias: effectiveAlias)
+    let coordinates = try DPoPUtils.getPublicCoordinates(fromRawPublicKey: try DPoPUtils.toRawPublicKey(keyPair.publicKey))
+    return DPoPUtils.getPublicKeyThumbprint(kty: "EC", crv: "P-256", x: coordinates.x, y: coordinates.y)
+  }
+
   func hasKeyPair(alias: String?) -> Bool {
     keyStore.hasKeyPair(alias: resolveAlias(alias))
   }
@@ -165,7 +184,7 @@ final class DPoPModule {
     try keyStore.generateKeyPair(alias: resolveAlias(alias))
   }
 
-  func signWithDpopPrivateKey(payload: String, alias: String?) throws -> String {
+  func signWithDPoPPrivateKey(payload: String, alias: String?) throws -> String {
     let effectiveAlias = resolveAlias(alias)
     if !keyStore.hasKeyPair(alias: effectiveAlias) {
       try keyStore.generateKeyPair(alias: effectiveAlias)
@@ -193,12 +212,11 @@ final class DPoPModule {
     kid: String?,
     jti: String?,
     iat: NSNumber?,
-    alias: String?
+    alias: String?,
+    requireHardwareBacked: Bool
   ) throws -> [String: Any] {
     let effectiveAlias = resolveAlias(alias)
-    if !keyStore.hasKeyPair(alias: effectiveAlias) {
-      try keyStore.generateKeyPair(alias: effectiveAlias)
-    }
+    try ensureKeyPair(alias: effectiveAlias, requireHardwareBacked: requireHardwareBacked)
     let keyPair = try keyStore.getKeyPair(alias: effectiveAlias)
     let coordinates = try DPoPUtils.getPublicCoordinates(fromRawPublicKey: try DPoPUtils.toRawPublicKey(keyPair.publicKey))
 
@@ -239,6 +257,13 @@ final class DPoPModule {
 
     if let additional {
       for (key, value) in additional {
+        if reservedDPoPClaims.contains(key) {
+          throw NSError(
+            domain: "ReactNativeDPoP",
+            code: 0,
+            userInfo: [NSLocalizedDescriptionKey: "additional must not override reserved DPoP claim: \(key)"]
+          )
+        }
         payload[key] = value
       }
     }
@@ -296,14 +321,6 @@ final class DPoPModule {
     }
   }
 
-  func calculateThumbprint(_ alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
-    do {
-      resolve(try DPoPModule.shared.calculateThumbprint(alias: alias))
-    } catch {
-      reject("ERR_DPOP_CALCULATE_THUMBPRINT", error.localizedDescription, error)
-    }
-  }
-
   func deleteKeyPair(_ alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
     do {
       try DPoPModule.shared.deleteKeyPair(alias: alias)
@@ -341,6 +358,14 @@ final class DPoPModule {
     }
   }
 
+  func getPublicKeyThumbprint(_ alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
+    do {
+      resolve(try DPoPModule.shared.getPublicKeyThumbprint(alias: alias))
+    } catch {
+      reject("ERR_DPOP_CALCULATE_THUMBPRINT", error.localizedDescription, error)
+    }
+  }
+
   func hasKeyPair(_ alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
     resolve(DPoPModule.shared.hasKeyPair(alias: alias))
   }
@@ -362,9 +387,9 @@ final class DPoPModule {
     }
   }
 
-  func signWithDpopPrivateKey(_ payload: String, alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
+  func signWithDPoPPrivateKey(_ payload: String, alias: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
     do {
-      resolve(try DPoPModule.shared.signWithDpopPrivateKey(payload: payload, alias: alias))
+      resolve(try DPoPModule.shared.signWithDPoPPrivateKey(payload: payload, alias: alias))
     } catch {
       reject("ERR_DPOP_SIGN_WITH_PRIVATE_KEY", error.localizedDescription, error)
     }
@@ -380,6 +405,7 @@ final class DPoPModule {
     jti: String?,
     iat: Any?,
     alias: String?,
+    requireHardwareBacked: Bool,
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock
   ) {
@@ -401,7 +427,8 @@ final class DPoPModule {
           kid: kid,
           jti: jti,
           iat: normalizedIat,
-          alias: alias
+          alias: alias,
+          requireHardwareBacked: requireHardwareBacked
         )
       )
     } catch {

package/ios/DPoPModuleBridge.mm

@@ -21,10 +21,6 @@ RCT_EXTERN_METHOD(assertHardwareBacked:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(calculateThumbprint:(NSString * _Nullable)alias
-                  resolve:(RCTPromiseResolveBlock)resolve
-                  reject:(RCTPromiseRejectBlock)reject)
-
 RCT_EXTERN_METHOD(deleteKeyPair:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
@@ -45,6 +41,10 @@ RCT_EXTERN_METHOD(getPublicKeyRaw:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
 
+RCT_EXTERN_METHOD(getPublicKeyThumbprint:(NSString * _Nullable)alias
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
 RCT_EXTERN_METHOD(hasKeyPair:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
@@ -58,7 +58,7 @@ RCT_EXTERN_METHOD(rotateKeyPair:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(signWithDpopPrivateKey:(NSString *)payload
+RCT_EXTERN_METHOD(signWithDPoPPrivateKey:(NSString *)payload
                   alias:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
@@ -72,6 +72,7 @@ RCT_EXTERN_METHOD(generateProof:(NSString *)htu
                   jti:(NSString * _Nullable)jti
                   iat:(id _Nullable)iat
                   alias:(NSString * _Nullable)alias
+                  requireHardwareBacked:(BOOL)requireHardwareBacked
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)
 

package/ios/DPoPUtils.swift

@@ -28,11 +28,6 @@ enum DPoPUtils {
     return base64UrlEncode(sha256(data))
   }
 
-  static func calculateThumbprint(kty: String, crv: String, x: String, y: String) -> String {
-    let canonical = "{\"crv\":\"\(crv)\",\"kty\":\"\(kty)\",\"x\":\"\(x)\",\"y\":\"\(y)\"}"
-    return base64UrlEncode(sha256(Data(canonical.utf8)))
-  }
-
   static func jsonData(_ object: Any) throws -> Data {
     if #available(iOS 11.0, *) {
       return try JSONSerialization.data(withJSONObject: object, options: [.sortedKeys])
@@ -92,6 +87,11 @@ enum DPoPUtils {
     return (base64UrlEncode(x), base64UrlEncode(y))
   }
 
+  static func getPublicKeyThumbprint(kty: String, crv: String, x: String, y: String) -> String {
+    let canonical = "{\"crv\":\"\(crv)\",\"kty\":\"\(kty)\",\"x\":\"\(x)\",\"y\":\"\(y)\"}"
+    return base64UrlEncode(sha256(Data(canonical.utf8)))
+  }
+
   static func toRawPublicKey(_ publicKey: SecKey) throws -> Data {
     var error: Unmanaged<CFError>?
     guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {

package/lib/module/NativeReactNativeDPoP.js

@@ -1,8 +1,8 @@
 "use strict";
 
 import { NativeModules, TurboModuleRegistry } from 'react-native';
-const nativeDpopModule =
+const nativeDPoPModule =
 // eslint-disable-next-line dot-notation -- required by noPropertyAccessFromIndexSignature from @tsconfig/strictest
 TurboModuleRegistry.get('ReactNativeDPoP') ?? NativeModules['ReactNativeDPoP'];
-export default nativeDpopModule;
+export default nativeDPoPModule;
 //# sourceMappingURL=NativeReactNativeDPoP.js.map

package/lib/module/NativeReactNativeDPoP.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeModules","TurboModuleRegistry","nativeDpopModule","get"],"sourceRoot":"../../src","sources":["NativeReactNativeDPoP.ts"],"mappings":";;AACA,SAASA,aAAa,EAAEC,mBAAmB,QAAQ,cAAc;AA4BjE,MAAMC,gBAAgB;AACpB;AACAD,mBAAmB,CAACE,GAAG,CAAO,iBAAiB,CAAC,IAAKH,aAAa,CAAC,iBAAiB,CAAsB;AAE5G,eAAeE,gBAAgB","ignoreList":[]}
+{"version":3,"names":["NativeModules","TurboModuleRegistry","nativeDPoPModule","get"],"sourceRoot":"../../src","sources":["NativeReactNativeDPoP.ts"],"mappings":";;AACA,SAASA,aAAa,EAAEC,mBAAmB,QAAQ,cAAc;AA6BjE,MAAMC,gBAAgB;AACpB;AACAD,mBAAmB,CAACE,GAAG,CAAO,iBAAiB,CAAC,IAAKH,aAAa,CAAC,iBAAiB,CAAsB;AAE5G,eAAeE,gBAAgB","ignoreList":[]}

package/lib/module/index.js

@@ -7,36 +7,27 @@ export class DPoP {
     this.proofContext = proofContext;
     this.alias = alias;
   }
-  async calculateThumbprint() {
-    return NativeReactNativeDPoP.calculateThumbprint(this.alias ?? null);
-  }
-  async getPublicKey(format) {
-    if (format === 'DER') {
-      return NativeReactNativeDPoP.getPublicKeyDer(this.alias ?? null);
-    }
-    if (format === 'RAW') {
-      return NativeReactNativeDPoP.getPublicKeyRaw(this.alias ?? null);
-    }
-    return NativeReactNativeDPoP.getPublicKeyJwk(this.alias ?? null);
+  static async assertHardwareBacked(alias) {
+    await NativeReactNativeDPoP.assertHardwareBacked(alias ?? null);
   }
-  async signWithDpopPrivateKey(payload) {
-    return NativeReactNativeDPoP.signWithDpopPrivateKey(payload, this.alias ?? null);
+  static async buildDPoPHeaders(input) {
+    const dPoP = await DPoP.generateProof(input);
+    return {
+      DPoP: dPoP.proof,
+      ...(input.accessToken ? {
+        Authorization: `DPoP ${input.accessToken}`
+      } : {})
+    };
   }
-  async isBoundToAlias(alias) {
-    return NativeReactNativeDPoP.isBoundToAlias(this.proof, alias ?? this.alias ?? null);
+  static async deleteKeyPair(alias) {
+    await NativeReactNativeDPoP.deleteKeyPair(alias ?? null);
   }
   static async generateProof(input) {
     const result = await NativeReactNativeDPoP.generateProof(input.htu, input.htm, input.nonce ?? null, input.accessToken ?? null, input.additional ?? null, input.kid ?? null, input.jti ?? null,
     // RN 0.75 Android bridge can crash when a nullable Double arrives as null.
-    input.iat ?? Math.floor(Date.now() / 1000), input.alias ?? null);
+    input.iat ?? Math.floor(Date.now() / 1000), input.alias ?? null, input.requireHardwareBacked ?? false);
     return new DPoP(result.proof, result.proofContext, input.alias);
   }
-  static async assertHardwareBacked(alias) {
-    await NativeReactNativeDPoP.assertHardwareBacked(alias ?? null);
-  }
-  static async deleteKeyPair(alias) {
-    await NativeReactNativeDPoP.deleteKeyPair(alias ?? null);
-  }
   static async getKeyInfo(alias) {
     return NativeReactNativeDPoP.getKeyInfo(alias ?? null);
   }
@@ -46,5 +37,23 @@ export class DPoP {
   static async rotateKeyPair(alias) {
     await NativeReactNativeDPoP.rotateKeyPair(alias ?? null);
   }
+  async getPublicKey(format) {
+    if (format === 'DER') {
+      return NativeReactNativeDPoP.getPublicKeyDer(this.alias ?? null);
+    }
+    if (format === 'RAW') {
+      return NativeReactNativeDPoP.getPublicKeyRaw(this.alias ?? null);
+    }
+    return NativeReactNativeDPoP.getPublicKeyJwk(this.alias ?? null);
+  }
+  async getPublicKeyThumbprint() {
+    return NativeReactNativeDPoP.getPublicKeyThumbprint(this.alias ?? null);
+  }
+  async isBoundToAlias(alias) {
+    return NativeReactNativeDPoP.isBoundToAlias(this.proof, alias ?? this.alias ?? null);
+  }
+  async signWithDPoPPrivateKey(payload) {
+    return NativeReactNativeDPoP.signWithDPoPPrivateKey(payload, this.alias ?? null);
+  }
 }
 //# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","calculateThumbprint","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","signWithDpopPrivateKey","payload","isBoundToAlias","generateProof","input","result","htu","htm","nonce","accessToken","additional","kid","jti","iat","Math","floor","Date","now","assertHardwareBacked","deleteKeyPair","getKeyInfo","hasKeyPair","rotateKeyPair"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AAqE3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,MAAaC,mBAAmBA,CAAA,EAAoB;IAClD,OAAON,qBAAqB,CAACM,mBAAmB,CAAC,IAAI,CAACD,KAAK,IAAI,IAAI,CAAC;EACtE;EAEA,MAAaE,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACS,eAAe,CAAC,IAAI,CAACJ,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAIG,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACU,eAAe,CAAC,IAAI,CAACL,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACW,eAAe,CAAC,IAAI,CAACN,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAaO,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOb,qBAAqB,CAACY,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACR,KAAK,IAAI,IAAI,CAAC;EAClF;EAEA,MAAaS,cAAcA,CAACT,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACc,cAAc,CAAC,IAAI,CAACX,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,aAAoBU,aAAaA,CAACC,KAAyB,EAAiB;IAC1E,MAAMC,MAAM,GAAI,MAAMjB,qBAAqB,CAACe,aAAa,CACvDC,KAAK,CAACE,GAAG,EACTF,KAAK,CAACG,GAAG,EACTH,KAAK,CAACI,KAAK,IAAI,IAAI,EACnBJ,KAAK,CAACK,WAAW,IAAI,IAAI,EACzBL,KAAK,CAACM,UAAU,IAAI,IAAI,EACxBN,KAAK,CAACO,GAAG,IAAI,IAAI,EACjBP,KAAK,CAACQ,GAAG,IAAI,IAAI;IACjB;IACAR,KAAK,CAACS,GAAG,IAAIC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,EAC1Cb,KAAK,CAACX,KAAK,IAAI,IACjB,CAAyB;IAEzB,OAAO,IAAIJ,IAAI,CAACgB,MAAM,CAACd,KAAK,EAAEc,MAAM,CAACb,YAAY,EAAEY,KAAK,CAACX,KAAK,CAAC;EACjE;EAEA,aAAoByB,oBAAoBA,CAACzB,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAAC8B,oBAAoB,CAACzB,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoB0B,aAAaA,CAAC1B,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC+B,aAAa,CAAC1B,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoB2B,UAAUA,CAAC3B,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAACgC,UAAU,CAAC3B,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoB4B,UAAUA,CAAC5B,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAACiC,UAAU,CAAC5B,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoB6B,aAAaA,CAAC7B,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAACkC,aAAa,CAAC7B,KAAK,IAAI,IAAI,CAAC;EAC1D;AACF","ignoreList":[]}
+{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","assertHardwareBacked","buildDPoPHeaders","input","dPoP","generateProof","accessToken","Authorization","deleteKeyPair","result","htu","htm","nonce","additional","kid","jti","iat","Math","floor","Date","now","requireHardwareBacked","getKeyInfo","hasKeyPair","rotateKeyPair","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","getPublicKeyThumbprint","isBoundToAlias","signWithDPoPPrivateKey","payload"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AA2E3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,aAAoBC,oBAAoBA,CAACD,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAACM,oBAAoB,CAACD,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoBE,gBAAgBA,CAACC,KAAyB,EAAwB;IACpF,MAAMC,IAAI,GAAG,MAAMR,IAAI,CAACS,aAAa,CAACF,KAAK,CAAC;IAE5C,OAAO;MACLP,IAAI,EAAEQ,IAAI,CAACN,KAAK;MAChB,IAAIK,KAAK,CAACG,WAAW,GAAG;QAAEC,aAAa,EAAE,QAAQJ,KAAK,CAACG,WAAW;MAAG,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;EACH;EAEA,aAAoBE,aAAaA,CAACR,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAACa,aAAa,CAACR,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoBK,aAAaA,CAACF,KAAyB,EAAiB;IAC1E,MAAMM,MAAM,GAAI,MAAMd,qBAAqB,CAACU,aAAa,CACvDF,KAAK,CAACO,GAAG,EACTP,KAAK,CAACQ,GAAG,EACTR,KAAK,CAACS,KAAK,IAAI,IAAI,EACnBT,KAAK,CAACG,WAAW,IAAI,IAAI,EACzBH,KAAK,CAACU,UAAU,IAAI,IAAI,EACxBV,KAAK,CAACW,GAAG,IAAI,IAAI,EACjBX,KAAK,CAACY,GAAG,IAAI,IAAI;IACjB;IACAZ,KAAK,CAACa,GAAG,IAAIC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,EAC1CjB,KAAK,CAACH,KAAK,IAAI,IAAI,EACnBG,KAAK,CAACkB,qBAAqB,IAAI,KACjC,CAAyB;IAEzB,OAAO,IAAIzB,IAAI,CAACa,MAAM,CAACX,KAAK,EAAEW,MAAM,CAACV,YAAY,EAAEI,KAAK,CAACH,KAAK,CAAC;EACjE;EAEA,aAAoBsB,UAAUA,CAACtB,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAAC2B,UAAU,CAACtB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoBuB,UAAUA,CAACvB,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAAC4B,UAAU,CAACvB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoBwB,aAAaA,CAACxB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC6B,aAAa,CAACxB,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,MAAayB,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAO/B,qBAAqB,CAACgC,eAAe,CAAC,IAAI,CAAC3B,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAI0B,MAAM,KAAK,KAAK,EAAE;MACpB,OAAO/B,qBAAqB,CAACiC,eAAe,CAAC,IAAI,CAAC5B,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACkC,eAAe,CAAC,IAAI,CAAC7B,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAa8B,sBAAsBA,CAAA,EAAoB;IACrD,OAAOnC,qBAAqB,CAACmC,sBAAsB,CAAC,IAAI,CAAC9B,KAAK,IAAI,IAAI,CAAC;EACzE;EAEA,MAAa+B,cAAcA,CAAC/B,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACoC,cAAc,CAAC,IAAI,CAACjC,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,MAAagC,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOtC,qBAAqB,CAACqC,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACjC,KAAK,IAAI,IAAI,CAAC;EAClF;AACF","ignoreList":[]}

package/lib/typescript/examples/shared/DPoPExampleContent.d.ts

@@ -1,2 +1,2 @@
-export default function DPoPExampleContent(): import("react/jsx-runtime").JSX.Element;
+export default function DPoPExampleContent(): JSX.Element;
 //# sourceMappingURL=DPoPExampleContent.d.ts.map

package/lib/typescript/examples/shared/DPoPExampleContent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DPoPExampleContent.d.ts","sourceRoot":"","sources":["../../../../examples/shared/DPoPExampleContent.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,kBAAkB,4CA0BzC"}
+{"version":3,"file":"DPoPExampleContent.d.ts","sourceRoot":"","sources":["../../../../examples/shared/DPoPExampleContent.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,kBAAkB,IAAI,GAAG,CAAC,OAAO,CA2BxD"}

package/lib/typescript/examples/v0.75/App.d.ts

@@ -1,2 +1,2 @@
-export default function App(): import("react/jsx-runtime").JSX.Element;
+export default function App(): JSX.Element;
 //# sourceMappingURL=App.d.ts.map

package/lib/typescript/examples/v0.75/App.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.75/App.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,GAAG,4CAM1B"}
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.75/App.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAMzC"}

package/lib/typescript/examples/v0.83/App.d.ts

@@ -1,2 +1,2 @@
-export default function App(): import("react/jsx-runtime").JSX.Element;
+export default function App(): JSX.Element;
 //# sourceMappingURL=App.d.ts.map

package/lib/typescript/examples/v0.83/App.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.83/App.tsx"],"names":[],"mappings":"AAKA,MAAM,CAAC,OAAO,UAAU,GAAG,4CAM1B"}
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.83/App.tsx"],"names":[],"mappings":"AAKA,MAAM,CAAC,OAAO,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAMzC"}

package/lib/typescript/src/NativeReactNativeDPoP.d.ts

@@ -2,17 +2,17 @@ import type { TurboModule } from 'react-native';
 import type { UnsafeObject } from 'react-native/Libraries/Types/CodegenTypes';
 export interface Spec extends TurboModule {
     assertHardwareBacked(alias: string | null): Promise<void>;
-    calculateThumbprint(alias: string | null): Promise<string>;
     deleteKeyPair(alias: string | null): Promise<void>;
+    generateProof(htu: string, htm: string, nonce: string | null, accessToken: string | null, additional: UnsafeObject | null, kid: string | null, jti: string | null, iat: number | null, alias: string | null, requireHardwareBacked: boolean): Promise<UnsafeObject>;
     getKeyInfo(alias: string | null): Promise<UnsafeObject>;
     getPublicKeyDer(alias: string | null): Promise<string>;
     getPublicKeyJwk(alias: string | null): Promise<UnsafeObject>;
     getPublicKeyRaw(alias: string | null): Promise<string>;
+    getPublicKeyThumbprint(alias: string | null): Promise<string>;
     hasKeyPair(alias: string | null): Promise<boolean>;
     isBoundToAlias(proof: string, alias: string | null): Promise<boolean>;
     rotateKeyPair(alias: string | null): Promise<void>;
-    signWithDpopPrivateKey(payload: string, alias: string | null): Promise<string>;
-    generateProof(htu: string, htm: string, nonce: string | null, accessToken: string | null, additional: UnsafeObject | null, kid: string | null, jti: string | null, iat: number | null, alias: string | null): Promise<UnsafeObject>;
+    signWithDPoPPrivateKey(payload: string, alias: string | null): Promise<string>;
 }
 declare const _default: Spec;
 export default _default;

package/lib/typescript/src/NativeReactNativeDPoP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NativeReactNativeDPoP.d.ts","sourceRoot":"","sources":["../../../src/NativeReactNativeDPoP.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,UAAU,EAAE,YAAY,GAAG,IAAI,EAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1B;wBAMkC,IAAI;AAAvC,wBAAwC"}
+{"version":3,"file":"NativeReactNativeDPoP.d.ts","sourceRoot":"","sources":["../../../src/NativeReactNativeDPoP.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,UAAU,EAAE,YAAY,GAAG,IAAI,EAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,qBAAqB,EAAE,OAAO,GAC7B,OAAO,CAAC,YAAY,CAAC,CAAC;IACzB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChF;wBAMkC,IAAI;AAAvC,wBAAwC"}

package/lib/typescript/src/index.d.ts

@@ -1,7 +1,7 @@
 type AdditionalClaims = Record<string, unknown>;
 export type PublicJwk = {
-    kty: 'EC';
     crv: 'P-256';
+    kty: 'EC';
     x: string;
     y: string;
 };
@@ -10,64 +10,70 @@ export type SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'P
 export type AndroidSecurityLevelName = 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STRONGBOX';
 export type IOSSecurityLevelName = 'SOFTWARE' | 'SECURE_ENCLAVE';
 export type DPoPKeyInfo = {
-    alias: string;
-    hasKeyPair: boolean;
     algorithm?: string;
+    alias: string;
     curve?: string;
-    insideSecureHardware?: boolean;
     hardware?: {
         android?: {
-            strongBoxAvailable: boolean;
-            strongBoxBacked: boolean;
             securityLevel?: number;
             securityLevelName?: AndroidSecurityLevelName;
+            strongBoxAvailable: boolean;
+            strongBoxBacked: boolean;
             strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
         };
         ios?: {
             secureEnclaveAvailable: boolean;
             secureEnclaveBacked: boolean;
+            secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
             securityLevel?: number | null;
             securityLevelName?: IOSSecurityLevelName;
-            secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
         };
     };
+    hasKeyPair: boolean;
+    insideSecureHardware?: boolean;
 };
 export type GenerateProofInput = {
-    htu: string;
-    htm: string;
-    nonce?: string;
     accessToken?: string;
     additional?: AdditionalClaims;
-    kid?: string;
-    jti?: string;
-    iat?: number;
     alias?: string;
+    htm: string;
+    htu: string;
+    iat?: number;
+    jti?: string;
+    kid?: string;
+    nonce?: string;
+    requireHardwareBacked?: boolean;
+};
+export type DPoPHeaders = {
+    Authorization?: string;
+    DPoP: string;
 };
 export type DPoPProofContext = {
-    htu: string;
-    htm: string;
-    nonce: string | null;
-    ath: string | null;
     additional: AdditionalClaims | null;
-    kid: string | null;
-    jti: string;
+    ath: string | null;
+    htm: string;
+    htu: string;
     iat: number;
+    jti: string;
+    kid: string | null;
+    nonce: string | null;
 };
 export declare class DPoP {
-    readonly proof: string;
     readonly alias: string | undefined;
+    readonly proof: string;
     readonly proofContext: DPoPProofContext;
     private constructor();
-    calculateThumbprint(): Promise<string>;
-    getPublicKey(format: PublicKeyFormat): Promise<PublicJwk | string>;
-    signWithDpopPrivateKey(payload: string): Promise<string>;
-    isBoundToAlias(alias?: string): Promise<boolean>;
-    static generateProof(input: GenerateProofInput): Promise<DPoP>;
     static assertHardwareBacked(alias?: string): Promise<void>;
+    static buildDPoPHeaders(input: GenerateProofInput): Promise<DPoPHeaders>;
     static deleteKeyPair(alias?: string): Promise<void>;
+    static generateProof(input: GenerateProofInput): Promise<DPoP>;
     static getKeyInfo(alias?: string): Promise<DPoPKeyInfo>;
     static hasKeyPair(alias?: string): Promise<boolean>;
     static rotateKeyPair(alias?: string): Promise<void>;
+    getPublicKey(format: PublicKeyFormat): Promise<PublicJwk | string>;
+    getPublicKeyThumbprint(): Promise<string>;
+    isBoundToAlias(alias?: string): Promise<boolean>;
+    signWithDPoPPrivateKey(payload: string): Promise<string>;
 }
 export {};
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,4BAA4B,GAAG,aAAa,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAC5G,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,qBAAqB,GAAG,WAAW,CAAC;AACxF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE;YACR,kBAAkB,EAAE,OAAO,CAAC;YAC5B,eAAe,EAAE,OAAO,CAAC;YACzB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;YAC7C,uBAAuB,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,sBAAsB,EAAE,OAAO,CAAC;YAChC,mBAAmB,EAAE,OAAO,CAAC;YAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC9B,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;YACzC,2BAA2B,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SACnE,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;IAMM,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAIzC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAiBvD,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,4BAA4B,GAAG,aAAa,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAC5G,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,qBAAqB,GAAG,WAAW,CAAC;AACxF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE;YACR,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;YAC7C,kBAAkB,EAAE,OAAO,CAAC;YAC5B,eAAe,EAAE,OAAO,CAAC;YACzB,uBAAuB,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,sBAAsB,EAAE,OAAO,CAAC;YAChC,mBAAmB,EAAE,OAAO,CAAC;YAC7B,2BAA2B,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;YAClE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC9B,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;SAC1C,CAAC;KACH,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;WAMa,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;WASjE,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAkBvD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGtE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-dpop",
-  "version": "0.4.0",
+  "version": "1.0.0",
   "description": "React Native library for DPoP proof generation and key management.",
   "keywords": [
     "android",

package/src/NativeReactNativeDPoP.ts

@@ -4,16 +4,7 @@ import type { UnsafeObject } from 'react-native/Libraries/Types/CodegenTypes';
 
 export interface Spec extends TurboModule {
   assertHardwareBacked(alias: string | null): Promise<void>;
-  calculateThumbprint(alias: string | null): Promise<string>;
   deleteKeyPair(alias: string | null): Promise<void>;
-  getKeyInfo(alias: string | null): Promise<UnsafeObject>;
-  getPublicKeyDer(alias: string | null): Promise<string>;
-  getPublicKeyJwk(alias: string | null): Promise<UnsafeObject>;
-  getPublicKeyRaw(alias: string | null): Promise<string>;
-  hasKeyPair(alias: string | null): Promise<boolean>;
-  isBoundToAlias(proof: string, alias: string | null): Promise<boolean>;
-  rotateKeyPair(alias: string | null): Promise<void>;
-  signWithDpopPrivateKey(payload: string, alias: string | null): Promise<string>;
   generateProof(
     htu: string,
     htm: string,
@@ -23,12 +14,22 @@ export interface Spec extends TurboModule {
     kid: string | null,
     jti: string | null,
     iat: number | null,
-    alias: string | null
+    alias: string | null,
+    requireHardwareBacked: boolean
   ): Promise<UnsafeObject>;
+  getKeyInfo(alias: string | null): Promise<UnsafeObject>;
+  getPublicKeyDer(alias: string | null): Promise<string>;
+  getPublicKeyJwk(alias: string | null): Promise<UnsafeObject>;
+  getPublicKeyRaw(alias: string | null): Promise<string>;
+  getPublicKeyThumbprint(alias: string | null): Promise<string>;
+  hasKeyPair(alias: string | null): Promise<boolean>;
+  isBoundToAlias(proof: string, alias: string | null): Promise<boolean>;
+  rotateKeyPair(alias: string | null): Promise<void>;
+  signWithDPoPPrivateKey(payload: string, alias: string | null): Promise<string>;
 }
 
-const nativeDpopModule =
+const nativeDPoPModule =
   // eslint-disable-next-line dot-notation -- required by noPropertyAccessFromIndexSignature from @tsconfig/strictest
   TurboModuleRegistry.get<Spec>('ReactNativeDPoP') ?? (NativeModules['ReactNativeDPoP'] as Spec | undefined);
 
-export default nativeDpopModule as Spec;
+export default nativeDPoPModule as Spec;

package/src/index.tsx

@@ -3,8 +3,8 @@ import NativeReactNativeDPoP from './NativeReactNativeDPoP';
 type AdditionalClaims = Record<string, unknown>;
 
 export type PublicJwk = {
-  kty: 'EC';
   crv: 'P-256';
+  kty: 'EC';
   x: string;
   y: string;
 };
@@ -16,50 +16,56 @@ export type AndroidSecurityLevelName = 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STR
 export type IOSSecurityLevelName = 'SOFTWARE' | 'SECURE_ENCLAVE';
 
 export type DPoPKeyInfo = {
-  alias: string;
-  hasKeyPair: boolean;
   algorithm?: string;
+  alias: string;
   curve?: string;
-  insideSecureHardware?: boolean;
   hardware?: {
     android?: {
-      strongBoxAvailable: boolean;
-      strongBoxBacked: boolean;
       securityLevel?: number;
       securityLevelName?: AndroidSecurityLevelName;
+      strongBoxAvailable: boolean;
+      strongBoxBacked: boolean;
       strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
     };
     ios?: {
       secureEnclaveAvailable: boolean;
       secureEnclaveBacked: boolean;
+      secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
       securityLevel?: number | null;
       securityLevelName?: IOSSecurityLevelName;
-      secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
     };
   };
+  hasKeyPair: boolean;
+  insideSecureHardware?: boolean;
 };
 
 export type GenerateProofInput = {
-  htu: string;
-  htm: string;
-  nonce?: string;
   accessToken?: string;
   additional?: AdditionalClaims;
-  kid?: string;
-  jti?: string;
-  iat?: number;
   alias?: string;
+  htm: string;
+  htu: string;
+  iat?: number;
+  jti?: string;
+  kid?: string;
+  nonce?: string;
+  requireHardwareBacked?: boolean;
+};
+
+export type DPoPHeaders = {
+  Authorization?: string;
+  DPoP: string;
 };
 
 export type DPoPProofContext = {
-  htu: string;
-  htm: string;
-  nonce: string | null;
-  ath: string | null;
   additional: AdditionalClaims | null;
-  kid: string | null;
-  jti: string;
+  ath: string | null;
+  htm: string;
+  htu: string;
   iat: number;
+  jti: string;
+  kid: string | null;
+  nonce: string | null;
 };
 
 type GenerateProofResult = {
@@ -68,8 +74,8 @@ type GenerateProofResult = {
 };
 
 export class DPoP {
-  public readonly proof: string;
   public readonly alias: string | undefined;
+  public readonly proof: string;
   public readonly proofContext: DPoPProofContext;
 
   private constructor(proof: string, proofContext: DPoPProofContext, alias?: string) {
@@ -78,27 +84,21 @@ export class DPoP {
     this.alias = alias;
   }
 
-  public async calculateThumbprint(): Promise<string> {
-    return NativeReactNativeDPoP.calculateThumbprint(this.alias ?? null);
+  public static async assertHardwareBacked(alias?: string): Promise<void> {
+    await NativeReactNativeDPoP.assertHardwareBacked(alias ?? null);
   }
 
-  public async getPublicKey(format: PublicKeyFormat): Promise<PublicJwk | string> {
-    if (format === 'DER') {
-      return NativeReactNativeDPoP.getPublicKeyDer(this.alias ?? null);
-    }
-    if (format === 'RAW') {
-      return NativeReactNativeDPoP.getPublicKeyRaw(this.alias ?? null);
-    }
-
-    return NativeReactNativeDPoP.getPublicKeyJwk(this.alias ?? null) as Promise<PublicJwk>;
-  }
+  public static async buildDPoPHeaders(input: GenerateProofInput): Promise<DPoPHeaders> {
+    const dPoP = await DPoP.generateProof(input);
 
-  public async signWithDpopPrivateKey(payload: string): Promise<string> {
-    return NativeReactNativeDPoP.signWithDpopPrivateKey(payload, this.alias ?? null);
+    return {
+      DPoP: dPoP.proof,
+      ...(input.accessToken ? { Authorization: `DPoP ${input.accessToken}` } : {}),
+    };
   }
 
-  public async isBoundToAlias(alias?: string): Promise<boolean> {
-    return NativeReactNativeDPoP.isBoundToAlias(this.proof, alias ?? this.alias ?? null);
+  public static async deleteKeyPair(alias?: string): Promise<void> {
+    await NativeReactNativeDPoP.deleteKeyPair(alias ?? null);
   }
 
   public static async generateProof(input: GenerateProofInput): Promise<DPoP> {
@@ -112,20 +112,13 @@ export class DPoP {
       input.jti ?? null,
       // RN 0.75 Android bridge can crash when a nullable Double arrives as null.
       input.iat ?? Math.floor(Date.now() / 1000),
-      input.alias ?? null
+      input.alias ?? null,
+      input.requireHardwareBacked ?? false
     )) as GenerateProofResult;
 
     return new DPoP(result.proof, result.proofContext, input.alias);
   }
 
-  public static async assertHardwareBacked(alias?: string): Promise<void> {
-    await NativeReactNativeDPoP.assertHardwareBacked(alias ?? null);
-  }
-
-  public static async deleteKeyPair(alias?: string): Promise<void> {
-    await NativeReactNativeDPoP.deleteKeyPair(alias ?? null);
-  }
-
   public static async getKeyInfo(alias?: string): Promise<DPoPKeyInfo> {
     return NativeReactNativeDPoP.getKeyInfo(alias ?? null) as Promise<DPoPKeyInfo>;
   }
@@ -137,4 +130,27 @@ export class DPoP {
   public static async rotateKeyPair(alias?: string): Promise<void> {
     await NativeReactNativeDPoP.rotateKeyPair(alias ?? null);
   }
+
+  public async getPublicKey(format: PublicKeyFormat): Promise<PublicJwk | string> {
+    if (format === 'DER') {
+      return NativeReactNativeDPoP.getPublicKeyDer(this.alias ?? null);
+    }
+    if (format === 'RAW') {
+      return NativeReactNativeDPoP.getPublicKeyRaw(this.alias ?? null);
+    }
+
+    return NativeReactNativeDPoP.getPublicKeyJwk(this.alias ?? null) as Promise<PublicJwk>;
+  }
+
+  public async getPublicKeyThumbprint(): Promise<string> {
+    return NativeReactNativeDPoP.getPublicKeyThumbprint(this.alias ?? null);
+  }
+
+  public async isBoundToAlias(alias?: string): Promise<boolean> {
+    return NativeReactNativeDPoP.isBoundToAlias(this.proof, alias ?? this.alias ?? null);
+  }
+
+  public async signWithDPoPPrivateKey(payload: string): Promise<string> {
+    return NativeReactNativeDPoP.signWithDPoPPrivateKey(payload, this.alias ?? null);
+  }
 }