@simplewebauthn/server 13.3.2 → 14.0.0

package/esm/helpers/iso/isoCrypto/verifyOKP.js

@@ -1,6 +1,6 @@
 import { COSECRV, COSEKEYS, isCOSEAlg } from '../../cose.js';
 import { isoBase64URL } from '../../index.js';
-import { importKey } from './importKey.js';
+import { importJWKKey } from './importJWKKey.js';
 import { getWebCrypto } from './getWebCrypto.js';
 export async function verifyOKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -40,10 +40,7 @@ export async function verifyOKP(opts) {
         name: _crv,
         namedCurve: _crv,
     };
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     const verifyAlgorithm = {
         name: _crv,
     };

package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
+{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAwFnB"}

package/esm/helpers/iso/isoCrypto/verifyRSA.js

@@ -1,6 +1,6 @@
 import { COSEKEYS, isCOSEAlg } from '../../cose.js';
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
-import { importKey } from './importKey.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
+import { importJWKKey } from './importJWKKey.js';
 import { isoBase64URL } from '../index.js';
 import { mapCoseAlgToWebCryptoKeyAlgName } from './mapCoseAlgToWebCryptoKeyAlgName.js';
 import { getWebCrypto } from './getWebCrypto.js';
@@ -34,13 +34,13 @@ export async function verifyRSA(opts) {
     };
     const keyAlgorithm = {
         name: mapCoseAlgToWebCryptoKeyAlgName(alg),
-        hash: { name: mapCoseAlgToWebCryptoAlg(alg) },
+        hash: { name: mapCoseAlgToWebCryptoHashAlgName(alg) },
     };
     const verifyAlgorithm = {
         name: mapCoseAlgToWebCryptoKeyAlgName(alg),
     };
     if (shaHashOverride) {
-        keyAlgorithm.hash.name = mapCoseAlgToWebCryptoAlg(shaHashOverride);
+        keyAlgorithm.hash.name = mapCoseAlgToWebCryptoHashAlgName(shaHashOverride);
     }
     if (keyAlgorithm.name === 'RSASSA-PKCS1-v1_5') {
         if (keyAlgorithm.hash.name === 'SHA-256') {
@@ -83,9 +83,6 @@ export async function verifyRSA(opts) {
     else {
         throw new Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);
     }
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }

package/esm/helpers/logging.d.ts

@@ -1,16 +1,34 @@
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
+ * A basic logging interface that enables projects to capture logging output from SimpleWebAuthn
+ * using whatever logging method is appropriate for the project. Logging levels can be defined
+ * independently to only capture desired levels.
  *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
+ * For example, a project using `console` statements to capture logs can use the following
+ * implementation of this interface:
  *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
+ * ```ts
+ * const ConsoleLogger: SimpleWebAuthnLogger = {
+ *   // debug(message: string, ...args: unknown[]) { console.debug(message, ...args); },
+ *   info(message: string, ...args: unknown[]) { console.info(message, ...args); },
+ *   warn(message: string, ...args: unknown[]) { console.warn(message, ...args); },
+ *   error(message: string, ...args: unknown[]) { console.error(message, ...args); },
+ * };
  * ```
  */
-export declare function getLogger(_name: string): (message: string, ..._rest: unknown[]) => void;
+export interface SimpleWebAuthnLogger {
+    debug?: (message: string, ...args: unknown[]) => void;
+    info?: (message: string, ...args: unknown[]) => void;
+    warn?: (message: string, ...args: unknown[]) => void;
+    error?: (message: string, ...args: unknown[]) => void;
+}
+/**
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
+ */
+export declare const DefaultNoopLogger: Required<SimpleWebAuthnLogger>;
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export declare function buildLoggerAllMethods(logger: SimpleWebAuthnLogger): Required<SimpleWebAuthnLogger>;
 //# sourceMappingURL=logging.d.ts.map

package/esm/helpers/logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAGvF"}
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACvD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,oBAAoB,CAK5D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,oBAAoB,CAAC,CAoBhC"}

package/esm/helpers/logging.js

@@ -1,19 +1,30 @@
-// const defaultLogger = debug('SimpleWebAuthn');
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
- *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
- *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
- * ```
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
  */
-export function getLogger(_name) {
-    // This is a noop for now while I search for a better debug logger technique
-    return (_message, ..._rest) => { };
+export const DefaultNoopLogger = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export function buildLoggerAllMethods(logger) {
+    const toReturn = { ...DefaultNoopLogger };
+    if (logger.debug) {
+        toReturn.debug = logger.debug;
+    }
+    if (logger.info) {
+        toReturn.info = logger.info;
+    }
+    if (logger.warn) {
+        toReturn.warn = logger.warn;
+    }
+    if (logger.error) {
+        toReturn.error = logger.error;
+    }
+    return toReturn;
 }

package/esm/helpers/mapJWSAlgToCOSEAlg.d.ts

@@ -0,0 +1,8 @@
+import { COSEALG } from './cose.js';
+/**
+ * Map JWS algorithms to COSE algorithm IDs
+ *
+ * See https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1 for possible values
+ */
+export declare function mapJWSAlgToCOSEAlg(alg: string): COSEALG;
+//# sourceMappingURL=mapJWSAlgToCOSEAlg.d.ts.map

package/esm/helpers/mapJWSAlgToCOSEAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapJWSAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapJWSAlgToCOSEAlg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoBvD"}

package/esm/helpers/mapJWSAlgToCOSEAlg.js

@@ -0,0 +1,31 @@
+import { COSEALG } from './cose.js';
+/**
+ * Map JWS algorithms to COSE algorithm IDs
+ *
+ * See https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1 for possible values
+ */
+export function mapJWSAlgToCOSEAlg(alg) {
+    let algCOSE;
+    if (alg === 'ES256') {
+        algCOSE = COSEALG.ES256;
+    }
+    else if (alg === 'ES384') {
+        algCOSE = COSEALG.ES384;
+    }
+    else if (alg === 'ES512') {
+        algCOSE = COSEALG.ES512;
+    }
+    else if (alg === 'RS256') {
+        algCOSE = COSEALG.RS256;
+    }
+    else if (alg === 'RS384') {
+        algCOSE = COSEALG.RS384;
+    }
+    else if (alg === 'RS512') {
+        algCOSE = COSEALG.RS512;
+    }
+    else {
+        throw new Error(`Unable to map JWS algorithm "${alg}" to a COSE algorithm`);
+    }
+    return algCOSE;
+}

package/esm/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}

package/esm/helpers/validateCertificatePath.js

@@ -79,15 +79,33 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
-            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            // Attempt to build a certificate path
             const chain = await chainBuilder.build(x5cLeafCert);
-            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
-            if (chain.length < numUniqueCerts) {
-                // Invalid cert chain, try the next trust anchor
-                continue;
+            /**
+             * The cert chain must chain to the anchor. Usually this is as simple as asserting that the
+             * final cert in the chain is the anchor cert. However there's an odd scenario where an
+             * intermediate certificate can chain to an anchor cert's public key, but not actually to the
+             * anchor cert because e.g. the chain builder stopped at a cross-signed cert for the anchor
+             * and not the anchor cert itself.
+             *
+             * So here we're going to check for that. In the simplest case we'll be fine with the last
+             * cert in the chain being byte-equivalent to the current anchor cert. If not, then move a
+             * cert up the chain and explicitly check that it was signed by the anchor cert. This also
+             * future-proofs this logic from the internals of whatever future X.509 library might be used
+             * to build the cert path.
+             */
+            const lastCert = chain[chain.length - 1];
+            const lastCertEqualsAnchor = lastCert.equal(anchor);
+            let certBeforeLastSignedByAnchor = false;
+            if (!lastCertEqualsAnchor && chain.length > 1) {
+                const certBeforeLast = chain[chain.length - 2];
+                certBeforeLastSignedByAnchor = await certBeforeLast.verify({
+                    publicKey: anchor.publicKey,
+                    signatureOnly: true,
+                });
             }
-            // Check if the chain is to the trust anchor
-            if (chain[chain.length - 1].subject !== anchor.subject) {
+            const chainReachesAnchor = lastCertEqualsAnchor || certBeforeLastSignedByAnchor;
+            if (!chainReachesAnchor) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }

package/esm/metadata/verifyJWT.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B9E"}
+{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAgC9E"}

package/esm/metadata/verifyJWT.js

@@ -1,6 +1,7 @@
 import { convertX509PublicKeyToCOSE } from '../helpers/convertX509PublicKeyToCOSE.js';
 import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
-import { COSEALG, COSEKEYS, isCOSEPublicKeyEC2, isCOSEPublicKeyRSA } from '../helpers/cose.js';
+import { COSEKEYS, isCOSEPublicKeyEC2, isCOSEPublicKeyRSA } from '../helpers/cose.js';
+import { mapJWSAlgToCOSEAlg } from '../helpers/mapJWSAlgToCOSEAlg.js';
 import { verifyEC2 } from '../helpers/iso/isoCrypto/verifyEC2.js';
 import { verifyRSA } from '../helpers/iso/isoCrypto/verifyRSA.js';
 /**
@@ -17,12 +18,15 @@ export function verifyJWT(jwt, leafCert) {
     const certCOSE = convertX509PublicKeyToCOSE(leafCert);
     const data = isoUint8Array.fromUTF8String(`${header}.${payload}`);
     const signatureBytes = isoBase64URL.toBuffer(signature);
+    // We just need the `alg` from the header, so only partially define the shape of it
+    const headerJSON = JSON.parse(isoBase64URL.toUTF8String(header));
+    const jwtHeaderHashAlgCOSE = mapJWSAlgToCOSEAlg(headerJSON.alg);
     if (isCOSEPublicKeyEC2(certCOSE)) {
         return verifyEC2({
             data,
             signature: signatureBytes,
             cosePublicKey: certCOSE,
-            shaHashOverride: COSEALG.ES256,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
         });
     }
     else if (isCOSEPublicKeyRSA(certCOSE)) {
@@ -30,6 +34,7 @@ export function verifyJWT(jwt, leafCert) {
             data,
             signature: signatureBytes,
             cosePublicKey: certCOSE,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
         });
     }
     const kty = certCOSE.get(COSEKEYS.kty);

package/esm/registration/generateRegistrationOptions.d.ts

@@ -1,11 +1,13 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, Base64URLString, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import { COSEALG } from '../helpers/cose.js';
 export type GenerateRegistrationOptionsOpts = Parameters<typeof generateRegistrationOptions>[0];
 /**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ * Use the most commonly-supported algorithms
+ * See the following:
+ *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[];
+export declare let defaultSupportedAlgorithmIDs: COSEALG[];
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -22,7 +24,7 @@ export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 export declare function generateRegistrationOptions(options: {
@@ -36,11 +38,11 @@ export declare function generateRegistrationOptions(options: {
     attestationType?: 'direct' | 'enterprise' | 'none';
     excludeCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     authenticatorSelection?: AuthenticatorSelectionCriteria;
     extensions?: AuthenticationExtensionsClientInputs;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     preferredAuthenticatorType?: 'securityKey' | 'localDevice' | 'remoteDevice';
 }): Promise<PublicKeyCredentialCreationOptionsJSON>;
 //# sourceMappingURL=generateRegistrationOptions.d.ts.map

package/esm/registration/generateRegistrationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
+{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAchG;;;;;GAKG;AACH,eAAO,IAAI,4BAA4B,EAAE,OAAO,EAI/C,CAAC;AAMF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}

package/esm/registration/generateRegistrationOptions.js

@@ -1,33 +1,8 @@
+import { SettingsService } from '../services/settingsService.js';
 import { generateChallenge } from '../helpers/generateChallenge.js';
 import { generateUserID } from '../helpers/generateUserID.js';
 import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
-/**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
- */
-export const supportedCOSEAlgorithmIdentifiers = [
-    // EdDSA (In first position to encourage authenticators to use this over ES256)
-    -8,
-    // ECDSA w/ SHA-256
-    -7,
-    // ECDSA w/ SHA-512
-    -36,
-    // RSASSA-PSS w/ SHA-256
-    -37,
-    // RSASSA-PSS w/ SHA-384
-    -38,
-    // RSASSA-PSS w/ SHA-512
-    -39,
-    // RSASSA-PKCS1-v1_5 w/ SHA-256
-    -257,
-    // RSASSA-PKCS1-v1_5 w/ SHA-384
-    -258,
-    // RSASSA-PKCS1-v1_5 w/ SHA-512
-    -259,
-    // RSASSA-PKCS1-v1_5 w/ SHA-1 (Deprecated; here for legacy support)
-    -65535,
-];
+import { COSEALG } from '../helpers/cose.js';
 /**
  * Set up some default authenticator selection options as per the latest spec:
  * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria
@@ -45,7 +20,14 @@ const defaultAuthenticatorSelection = {
  *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
  *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-const defaultSupportedAlgorithmIDs = [-8, -7, -257];
+export let defaultSupportedAlgorithmIDs = [
+    COSEALG.EdDSA,
+    COSEALG.ES256,
+    COSEALG.RS256,
+];
+if (SettingsService.runtimeSupportsPQC()) {
+    defaultSupportedAlgorithmIDs = [COSEALG.ML_DSA_44, ...defaultSupportedAlgorithmIDs];
+}
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -62,7 +44,7 @@ const defaultSupportedAlgorithmIDs = [-8, -7, -257];
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 export async function generateRegistrationOptions(options) {

package/esm/registration/verifications/tpm/constants.d.ts

@@ -25,7 +25,7 @@ export declare const TPM_ALG: {
 export declare const TPM_ECC_CURVE: {
     [key: number]: string;
 };
-type ManufacturerInfo = {
+export type ManufacturerInfo = {
     name: string;
     id: string;
 };
@@ -44,5 +44,4 @@ export declare const TPM_MANUFACTURERS: {
 export declare const TPM_ECC_CURVE_COSE_CRV_MAP: {
     [key: string]: number;
 };
-export {};
 //# sourceMappingURL=constants.d.ts.map

package/esm/registration/verifications/tpm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAgChE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CA+BhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}

package/esm/registration/verifications/tpm/constants.js

@@ -104,8 +104,7 @@ export const TPM_MANUFACTURERS = {
     'id:48504900': { name: 'HPI', id: 'HPI' },
     'id:48504500': { name: 'HPE', id: 'HPE' },
     'id:48495349': { name: 'Huawei', id: 'HISI' },
-    'id:49424d00': { name: 'IBM', id: 'IBM' },
-    'id:49424D00': { name: 'IBM', id: 'IBM' }, // Same ID for IBM as above, except the "D" is capitalized as per TPM spec
+    'id:49424D00': { name: 'IBM', id: 'IBM' }, // IBM is "id:49424d00" in the TPM spec. It's been normalized here
     'id:49465800': { name: 'Infineon', id: 'IFX' },
     'id:494E5443': { name: 'Intel', id: 'INTC' },
     'id:4C454E00': { name: 'Lenovo', id: 'LEN' },

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.d.ts

@@ -0,0 +1,3 @@
+import { type ManufacturerInfo } from './constants.js';
+export declare function getTPMManufacturerInfo(id: string): ManufacturerInfo | undefined;
+//# sourceMappingURL=isValidTPMManufacturerID.d.ts.map

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isValidTPMManufacturerID.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/isValidTPMManufacturerID.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,gBAAgB,CAAC;AAE1E,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAK/E"}

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.js

@@ -0,0 +1,6 @@
+import { TPM_MANUFACTURERS } from './constants.js';
+export function getTPMManufacturerInfo(id) {
+    // e.g. "id:51434f4d" -> "id:51434f4D"
+    const _normalized = `id:${id.substring(3).toUpperCase()}`;
+    return TPM_MANUFACTURERS[_normalized];
+}

package/esm/registration/verifications/tpm/verifyAttestationTPM.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAwBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}
+{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAyBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}

package/esm/registration/verifications/tpm/verifyAttestationTPM.js

@@ -11,9 +11,10 @@ import { isoUint8Array } from '../../../helpers/iso/index.js';
 import { validateExtFIDOGenCEAAGUID } from '../../../helpers/validateExtFIDOGenCEAAGUID.js';
 import { MetadataService } from '../../../services/metadataService.js';
 import { verifyAttestationWithMetadata } from '../../../metadata/verifyAttestationWithMetadata.js';
-import { TPM_ECC_CURVE_COSE_CRV_MAP, TPM_MANUFACTURERS } from './constants.js';
+import { TPM_ECC_CURVE_COSE_CRV_MAP } from './constants.js';
 import { parseCertInfo } from './parseCertInfo.js';
 import { parsePubArea } from './parsePubArea.js';
+import { getTPMManufacturerInfo } from './isValidTPMManufacturerID.js';
 export async function verifyAttestationTPM(options) {
     const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash, rootCertificates, } = options;
     const ver = attStmt.get('ver');
@@ -200,7 +201,7 @@ export async function verifyAttestationTPM(options) {
         throw new Error('Certificate did not contain ExtendedKeyUsage extension (TPM)');
     }
     // Check that tcpaTpmManufacturer (2.23.133.2.1) field is set to a valid manufacturer ID.
-    if (!TPM_MANUFACTURERS[tcgAtTpmManufacturer]) {
+    if (!getTPMManufacturerInfo(tcgAtTpmManufacturer)) {
         throw new Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);
     }
     // Check that certificate contains extKeyUsage (2.5.29.37) extension and it must contain

package/esm/registration/verifyRegistrationResponse.d.ts

@@ -1,4 +1,4 @@
-import type { COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
+import type { CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
 import { type AttestationFormat, type AttestationStatement } from '../helpers/decodeAttestationObject.js';
 import type { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 /**
@@ -17,7 +17,7 @@ export type VerifyRegistrationResponseOpts = Parameters<typeof verifyRegistratio
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 export declare function verifyRegistrationResponse(options: {
@@ -28,7 +28,7 @@ export declare function verifyRegistrationResponse(options: {
     expectedType?: string | string[];
     requireUserPresence?: boolean;
     requireUserVerification?: boolean;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     attestationSafetyNetEnforceCTSCheck?: boolean;
 }): Promise<VerifiedRegistrationResponse>;
 /**

package/esm/registration/verifyRegistrationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}

package/esm/registration/verifyRegistrationResponse.js

@@ -9,7 +9,7 @@ import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
 import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
 import { isoBase64URL } from '../helpers/iso/index.js';
 import { SettingsService } from '../services/settingsService.js';
-import { supportedCOSEAlgorithmIdentifiers } from './generateRegistrationOptions.js';
+import { defaultSupportedAlgorithmIDs } from './generateRegistrationOptions.js';
 import { verifyAttestationFIDOU2F } from './verifications/verifyAttestationFIDOU2F.js';
 import { verifyAttestationPacked } from './verifications/verifyAttestationPacked.js';
 import { verifyAttestationAndroidSafetyNet } from './verifications/verifyAttestationAndroidSafetyNet.js';
@@ -28,11 +28,11 @@ import { verifyAttestationApple } from './verifications/verifyAttestationApple.j
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 export async function verifyRegistrationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = supportedCOSEAlgorithmIdentifiers, attestationSafetyNetEnforceCTSCheck = true, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs, attestationSafetyNetEnforceCTSCheck = true, } = options;
     const { id, rawId, type: credentialType, response: attestationResponse } = response;
     // Ensure credential specified an ID
     if (!id) {

package/esm/services/defaultRootCerts/mds.d.ts

@@ -9,4 +9,15 @@
  * CB:B5:22:D7:B7:F1:27:AD:6A:01:13:86:5B:DF:1C:D4:10:2E:7D:07:59:AF:63:5A:7C:F4:72:0D:C9:63:C5:3B
  */
 export declare const GlobalSign_Root_CA_R3 = "-----BEGIN CERTIFICATE-----\nMIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G\nA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp\nZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4\nMTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG\nA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8\nRgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT\ngHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm\nKPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd\nQQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ\nXriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw\nDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o\nLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU\nRUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp\njjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK\n6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX\nmcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs\nMx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH\nWD9f\n-----END CERTIFICATE-----\n ";
+/**
+ * GlobalSign Root R46
+ *
+ * Downloaded from https://valid.r46.roots.globalsign.com/
+ *
+ * Valid until 2046-03-20 @ 00:00 PST
+ *
+ * SHA256 Fingerprint
+ * 4F:A3:12:6D:8D:3A:11:D1:C4:85:5A:4F:80:7C:BA:D6:CF:91:9D:3A:5A:88:B0:3B:EA:2C:63:72:D9:3C:40:C9
+ */
+export declare const GlobalSign_Root_R46 = "-----BEGIN CERTIFICATE-----\nMIIFWjCCA0KgAwIBAgISEdK7udcjGJ5AXwqdLdDfJWfRMA0GCSqGSIb3DQEBDAUA\nMEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYD\nVQQDExNHbG9iYWxTaWduIFJvb3QgUjQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMy\nMDAwMDAwMFowRjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYt\nc2ExHDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB\nAQUAA4ICDwAwggIKAoICAQCsrHQy6LNl5brtQyYdpokNRbopiLKkHWPd08EsCVeJ\nOaFV6Wc0dwxu5FUdUiXSE2te4R2pt32JMl8Nnp8semNgQB+msLZ4j5lUlghYruQG\nvGIFAha/r6gjA7aUD7xubMLL1aa7DOn2wQL7Id5m3RerdELv8HQvJfTqa1VbkNud\n316HCkD7rRlr+/fKYIje2sGP1q7Vf9Q8g+7XFkyDRTNrJ9CG0Bwta/OrffGFqfUo\n0q3v84RLHIf8E6M6cqJaESvWJ3En7YEtbWaBkoe0G1h6zD8K+kZPTXhc+CtI4wSE\ny132tGqzZfxCnlEmIyDLPRT5ge1lFgBPGmSXZgjPjHvjK8Cd+RTyG/FWaha/LIWF\nzXg4mutCagI0GIMXTpRW+LaCtfOW3T3zvn8gdz57GSNrLNRyc0NXfeD412lPFzYE\n+cCQYDdF3uYM2HSNrpyibXRdQr4G9dlkbgIQrImwTDsHTUB+JMWKmIJ5jqSngiCN\nI/onccnfxkF0oE32kRbcRoxfKWMxWXEM2G/CtjJ9++ZdU6Z+Ffy7dXxd7Pj2Fxzs\nx2sZy/N78CsHpdlseVR2bJ0cpm4O6XkMqCNqo98bMDGfsVR7/mrLZqrcZdCinkqa\nByFrgY/bxFn63iLABJzjqls2k+g9vXqhnQt2sQvHnf3PmKgGwvgqo6GDoLclcqUC\n4wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUA1yrc4GHqMywptWU4jaWSf8FmSwwDQYJKoZIhvcNAQEMBQADggIBAHx4\n7PYCLLtbfpIrXTncvtgdokIzTfnvpCo7RGkerNlFo048p9gkUbJUHJNOxO97k4Vg\nJuoJSOD1u8fpaNK7ajFxzHmuEajwmf3lH7wvqMxX63bEIaZHU1VNaL8FpO7XJqti\n2kM3S+LGteWygxk6x9PbTZ4IevPuzz5i+6zoYMzRx6Fcg0XERczzF2sUyQQCPtIk\npnnpHs6i58FZFZ8d4kuaPp92CC1r2LpXFNqD6v6MVenQTqnMdzGxRBF6XLE+0xRF\nFRhiJBPSy03OXIPBNvIQtQ6IbbjhVp+J3pZmOUdkLG5NrmJ7v2B0GbhWrJKsFjLt\nrWhV/pi60zTe9Mlhww6G9kuEYO4Ne7UyWHmRVSyBQ7N0H3qqJZ4d16GLuc1CLgSk\nZoNNiTW2bKg2SnkheCLQQrzRQDGQob4Ez8pn7fXwgNNgyYMqIgXQBztSvwyeqiv5\nu+YfjyW6hY0XHgL+XVAEV8/+LbzvXMAaq7afJMbfc2hIkCwU9D9SGuTSyxTDYWnP\n4vkYxboznxSjBF25cfe1lNj2M8FawTSLfJvdkzrnE6JwYZ+vj+vYxXX4M2bUdGc6\nN3ec592kD3ZDZopD8p/7DEJ4Y9HiD2971KE9dJeFt0g5QdYg/NA6s/rob8SKunE3\nvouXsXgxT7PntgMTzlSdriVZzH81Xwj3QEUxeCp6\n-----END CERTIFICATE-----\n";
 //# sourceMappingURL=mds.d.ts.map

package/esm/services/defaultRootCerts/mds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mds.d.ts","sourceRoot":"","sources":["../../../src/services/defaultRootCerts/mds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,wuCAqBhC,CAAC"}
+{"version":3,"file":"mds.d.ts","sourceRoot":"","sources":["../../../src/services/defaultRootCerts/mds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,wuCAqBhC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,+5DA+B/B,CAAC"}