@simplewebauthn/server 13.3.2 → 14.0.0

package/esm/types/index.d.ts

@@ -6,8 +6,8 @@
  *
  * deno task codegen:types
  */
-import type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationExtensionsClientOutputs, AuthenticatorAssertionResponse, AuthenticatorAttachment, AuthenticatorAttestationResponse, AuthenticatorSelectionCriteria, COSEAlgorithmIdentifier, PublicKeyCredential, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptions, PublicKeyCredentialRpEntity, PublicKeyCredentialType, UserVerificationRequirement } from './dom.js';
-export type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationExtensionsClientOutputs, AuthenticatorAssertionResponse, AuthenticatorAttachment, AuthenticatorAttestationResponse, AuthenticatorSelectionCriteria, AuthenticatorTransport, COSEAlgorithmIdentifier, Crypto, PublicKeyCredential, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptions, PublicKeyCredentialRpEntity, PublicKeyCredentialType, PublicKeyCredentialUserEntity, ResidentKeyRequirement, UserVerificationRequirement, } from './dom.js';
+import type { AlgorithmIdentifier, AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationExtensionsClientOutputs, AuthenticatorAssertionResponse, AuthenticatorAttachment, AuthenticatorAttestationResponse, AuthenticatorSelectionCriteria, Base64URLString, COSEAlgorithmIdentifier, KeyUsage, PublicKeyCredential, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptorJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptions, PublicKeyCredentialRpEntity, PublicKeyCredentialType, SubtleCrypto, UserVerificationRequirement } from './dom.js';
+export type { AlgorithmIdentifier, AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationExtensionsClientOutputs, AuthenticatorAssertionResponse, AuthenticatorAttachment, AuthenticatorAttestationResponse, AuthenticatorSelectionCriteria, AuthenticatorTransport, Base64URLString, COSEAlgorithmIdentifier, CredentialCreationOptions, CredentialRequestOptions, Crypto, PublicKeyCredential, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialDescriptorJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptions, PublicKeyCredentialRpEntity, PublicKeyCredentialType, PublicKeyCredentialUserEntity, ResidentKeyRequirement, UserVerificationRequirement, } from './dom.js';
 /**
  * A variant of PublicKeyCredentialCreationOptions suitable for JSON transmission to the browser to
  * (eventually) get passed into navigator.credentials.create(...) in the browser.
@@ -43,14 +43,6 @@ export interface PublicKeyCredentialRequestOptionsJSON {
     hints?: PublicKeyCredentialHint[];
     extensions?: AuthenticationExtensionsClientInputs;
 }
-/**
- * https://w3c.github.io/webauthn/#dictdef-publickeycredentialdescriptorjson
- */
-export interface PublicKeyCredentialDescriptorJSON {
-    id: Base64URLString;
-    type: PublicKeyCredentialType;
-    transports?: AuthenticatorTransportFuture[];
-}
 /**
  * https://w3c.github.io/webauthn/#dictdef-publickeycredentialuserentityjson
  */
@@ -63,7 +55,7 @@ export interface PublicKeyCredentialUserEntityJSON {
  * The value returned from navigator.credentials.create()
  */
 export interface RegistrationCredential extends PublicKeyCredentialFuture {
-    response: AuthenticatorAttestationResponseFuture;
+    response: AuthenticatorAttestationResponse;
 }
 /**
  * A slightly-modified RegistrationCredential to simplify working with ArrayBuffers that
@@ -109,7 +101,7 @@ export interface AuthenticatorAttestationResponseJSON {
     clientDataJSON: Base64URLString;
     attestationObject: Base64URLString;
     authenticatorData?: Base64URLString;
-    transports?: AuthenticatorTransportFuture[];
+    transports?: string[];
     publicKeyAlgorithm?: COSEAlgorithmIdentifier;
     publicKey?: Base64URLString;
 }
@@ -132,38 +124,8 @@ export type WebAuthnCredential = {
     id: Base64URLString;
     publicKey: Uint8Array_;
     counter: number;
-    transports?: AuthenticatorTransportFuture[];
+    transports?: string[];
 };
-/**
- * An attempt to communicate that this isn't just any string, but a Base64URL-encoded string
- */
-export type Base64URLString = string;
-/**
- * AuthenticatorAttestationResponse in TypeScript's DOM lib is outdated (up through v3.9.7).
- * Maintain an augmented version here so we can implement additional properties as the WebAuthn
- * spec evolves.
- *
- * See https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse
- *
- * Properties marked optional are not supported in all browsers.
- */
-export interface AuthenticatorAttestationResponseFuture extends AuthenticatorAttestationResponse {
-    getTransports(): AuthenticatorTransportFuture[];
-}
-/**
- * A super class of TypeScript's `AuthenticatorTransport` that includes support for the latest
- * transports. Should eventually be replaced by TypeScript's when TypeScript gets updated to
- * know about it (sometime after 4.6.3)
- */
-export type AuthenticatorTransportFuture = 'ble' | 'cable' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb';
-/**
- * A super class of TypeScript's `PublicKeyCredentialDescriptor` that knows about the latest
- * transports. Should eventually be replaced by TypeScript's when TypeScript gets updated to
- * know about it (sometime after 4.6.3)
- */
-export interface PublicKeyCredentialDescriptorFuture extends Omit<PublicKeyCredentialDescriptor, 'transports'> {
-    transports?: AuthenticatorTransportFuture[];
-}
 /** */
 export type PublicKeyCredentialJSON = RegistrationResponseJSON | AuthenticationResponseJSON;
 /**
@@ -174,7 +136,11 @@ export interface PublicKeyCredentialFuture extends PublicKeyCredential {
     isConditionalMediationAvailable?(): Promise<boolean>;
     parseCreationOptionsFromJSON?(options: PublicKeyCredentialCreationOptionsJSON): PublicKeyCredentialCreationOptions;
     parseRequestOptionsFromJSON?(options: PublicKeyCredentialRequestOptionsJSON): PublicKeyCredentialRequestOptions;
-    toJSON?(): PublicKeyCredentialJSON;
+    toJSON(): PublicKeyCredentialJSON;
+    getClientCapabilities?(): Promise<PublicKeyCredentialClientCapabilities>;
+    signalUnknownCredential(options: UnknownCredentialOptions): Promise<undefined>;
+    signalAllAcceptedCredentials(options: AllAcceptedCredentialsOptions): Promise<undefined>;
+    signalCurrentUserDetails(options: CurrentUserDetailsOptions): Promise<undefined>;
 }
 /**
  * The two types of credentials as defined by bit 3 ("Backup Eligibility") in authenticator data:
@@ -202,6 +168,27 @@ export type PublicKeyCredentialHint = 'hybrid' | 'security-key' | 'client-device
  * See https://www.iana.org/assignments/webauthn/webauthn.xhtml#webauthn-attestation-statement-format-ids
  */
 export type AttestationFormat = 'fido-u2f' | 'packed' | 'android-safetynet' | 'android-key' | 'tpm' | 'apple' | 'none';
+/**
+ * More specific values available from `PublicKeyCredential.getClientCapabilities()`.
+ *
+ * A capability with an `undefined` value does not mean the feature is unsupported. It may
+ * simply be that the browser has chosen not to divulge its support for the capability as a more
+ * specific determination may be factored into e.g. ad-tech's browser fingerprinting that violates
+ * user privacy against the goals of the browser.
+ *
+ * See https://w3c.github.io/webauthn/#typedefdef-publickeycredentialclientcapabilities
+ */
+export type PublicKeyCredentialClientCapabilities = {
+    conditionalCreate?: boolean;
+    conditionalGet?: boolean;
+    hybridTransport?: boolean;
+    passkeyPlatformAuthenticator?: boolean;
+    userVerifyingPlatformAuthenticator?: boolean;
+    relatedOrigins?: boolean;
+    signalAllAcceptedCredentials?: boolean;
+    signalCurrentUserDetails?: boolean;
+    signalUnknownCredential?: boolean;
+};
 /**
  * Equivalent to `Uint8Array` before TypeScript 5.7, and `Uint8Array<ArrayBuffer>` in TypeScript 5.7
  * and beyond.
@@ -217,4 +204,131 @@ export type AttestationFormat = 'fido-u2f' | 'packed' | 'android-safetynet' | 'a
  * https://github.com/denoland/std/blob/b5a5fe4f96b91c1fe8dba5cc0270092dd11d3287/bytes/_types.ts#L11
  */
 export type Uint8Array_ = ReturnType<Uint8Array['slice']>;
+/**
+ * Options for `PublicKeyCredential.signalUnknownCredential()`. This signal communicates that the
+ * credential that the user just tried to register, or to authenticate with, was not one that the
+ * Relying Party recognizes. The authenticator responsible for the credential can hide or delete
+ * the credential so that the user does not see it in the future as an option to sign in with.
+ *
+ * It is a good idea for a Relying Party to send this signal immediately after the use of an
+ * unrecognized credential. For example, after rejecting the output from `startRegistration()` due
+ * to unsatisfied RP-specific authenticator registration policy; or after rejecting the output from
+ * `startAuthentication()` because the user deleted the passkey from their RP-specific user
+ * settings.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalUnknownCredential for more info.
+ */
+type UnknownCredentialOptions = {
+    rpId: string;
+    credentialId: Base64URLString;
+};
+/**
+ * Options for `PublicKeyCredential.signalAllAcceptedCredentials()`. This signal communicates the
+ * current list of passkeys the Relying Party will recognize for use by the **authenticated** user
+ * on the next login. Authenticators that have a passkey for (rpId + userId), but the passkey ID is
+ * not found in allAcceptedCredentialIds, may choose to hide or delete the passkey because it will
+ * not be accepted for use by the Relying Party.
+ *
+ * It is a good idea for a Relying Party to periodically send this signal, for example after every
+ * successful authentication.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalAllAcceptedCredentials for more info.
+ */
+type AllAcceptedCredentialsOptions = {
+    rpId: string;
+    userId: Base64URLString;
+    allAcceptedCredentialIds: Base64URLString[];
+};
+/**
+ * Options for `PublicKeyCredential.signalCurrentUserDetails()`. This signal that communicates a
+ * change in the **authenticated** user's name and/or display name. This can help browsers and
+ * platforms display the most up-to-date information about the user during a passkey authentication
+ * instead of always showing whatever value was set at the time of registration.
+ *
+ * It is a good idea for a Relying Party to periodically send this signal, for example after every
+ * successful authentication and immediately after the user name and/or display name is changed.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalCurrentUserDetails for more info.
+ */
+type CurrentUserDetailsOptions = {
+    rpId: string;
+    userId: Base64URLString;
+    name: string;
+    displayName: string;
+};
+/**
+ * Below are types for @simplewebauthn/browser's `sendSignal()` method. Shared out of here so that an RP
+ * might use these same types in @simplewebauthn/server to type an API return value that can be
+ * passed into `sendSignal()`
+ */
+/**
+ * A signal that communicates that the credential that the user just tried to register, or to
+ * authenticate with, was not one that the Relying Party recognizes. The authenticator responsible
+ * for the credential can hide or delete the credential so that the user does not see it in the
+ * future as an option to sign in with.
+ *
+ * It is a good idea for a Relying Party to send this signal immediately after the use of an
+ * unrecognized credential. For example, after rejecting the output from `startRegistration()` due
+ * to unsatisfied RP-specific authenticator registration policy; or after rejecting the output from
+ * `startAuthentication()` because the user deleted the passkey from their RP-specific user
+ * settings.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalUnknownCredential for more info.
+ */
+export type SendSignalUnknownCredentialOpts = {
+    signalName: 'unknownCredential';
+    /** The same value used for `rpID` when calling \@simplewebauthn/server's `generateRegistrationOptions()` */
+    rpID: string;
+    /** The credential ID that the Relying Party didn't recognize for use */
+    credentialID: Base64URLString;
+};
+/**
+ * A signal that communicates the current list of passkeys the Relying Party will recognize for use
+ * by the **authenticated** user on the next login. Authenticators that have a passkey for
+ * (rpId + userId), but the passkey ID is not found in allAcceptedCredentialIds, may choose to hide
+ * or delete the passkey because it will not be accepted for use by the Relying Party.
+ *
+ * It is a good idea for a Relying Party to periodically send this signal, for example after every
+ * successful authentication.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalAllAcceptedCredentials for more info.
+ */
+export type SendSignalAllAcceptedCredentialsOpts = {
+    signalName: 'allAcceptedCredentials';
+    /** The same value used for `rpID` when calling \@simplewebauthn/server's `generateRegistrationOptions()` */
+    rpID: string;
+    /** The base64url-encoded value used for `userID` when calling \@simplewebauthn/server's `generateRegistrationOptions()` */
+    userID: Base64URLString;
+    /** An array of base64url-encoded credential IDs for all credentials the user may use to authenticate */
+    allAcceptedCredentialIDs: Base64URLString[];
+};
+/**
+ * A signal that communicates a change in the **authenticated** user's name and/or display name.
+ * This can help browsers and platforms display the most up-to-date information about the user
+ * during a passkey authentication instead of always showing whatever value was set at the time of
+ * registration.
+ *
+ * It is a good idea for a Relying Party to periodically send this signal, for example after every
+ * successful authentication and immediately after the user name and/or display name is changed.
+ *
+ * See https://w3c.github.io/webauthn/#sctn-signalCurrentUserDetails for more info.
+ */
+export type SendSignalCurrentUserDetailsOpts = {
+    signalName: 'currentUserDetails';
+    /** The same value used for `rpID` when calling \@simplewebauthn/server's `generateRegistrationOptions()` */
+    rpID: string;
+    /** The base64url-encoded value used for `userID` when calling \@simplewebauthn/server's `generateRegistrationOptions()` */
+    userID: Base64URLString;
+    /** The primary account name, like an email address, username, etc... */
+    userName: string;
+    /** An optional, longer user identifier, like a full name, account differentiator, etc... Defaults to `""` */
+    userDisplayName?: string;
+};
+/**
+ * A super class of TypeScript's `SubtleCrypto` that knows about upcoming features
+ */
+export interface SubtleCryptoFuture extends SubtleCrypto {
+    /** https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-supports */
+    supports(operation: KeyUsage, algorithm: AlgorithmIdentifier, length?: number): boolean;
+}
 //# sourceMappingURL=index.d.ts.map

package/esm/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,8BAA8B,EAC9B,uBAAuB,EACvB,mBAAmB,EACnB,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,EACvB,MAAM,EACN,mBAAmB,EACnB,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAElB;;;;;;;;GAQG;AACH,MAAM,WAAW,sCAAsC;IACrD,EAAE,EAAE,2BAA2B,CAAC;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,SAAS,EAAE,eAAe,CAAC;IAC3B,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,+BAA+B,CAAC;IAC9C,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,eAAe,CAAC;IACpB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,QAAQ,EAAE,sCAAsC,CAAC;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,eAAe,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,oCAAoC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,sBAAsB,EAAE,qCAAqC,CAAC;IAC9D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,eAAe,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,kCAAkC,CAAC;IAC7C,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,sBAAsB,EAAE,qCAAqC,CAAC;IAC9D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oCAAoC;IACnD,cAAc,EAAE,eAAe,CAAC;IAChC,iBAAiB,EAAE,eAAe,CAAC;IAEnC,iBAAiB,CAAC,EAAE,eAAe,CAAC;IAEpC,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAE5C,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,eAAe,CAAC;IAChC,iBAAiB,EAAE,eAAe,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,eAAe,CAAC;IACpB,SAAS,EAAE,WAAW,CAAC;IAEvB,OAAO,EAAE,MAAM,CAAC;IAEhB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,WAAW,sCAAuC,SAAQ,gCAAgC;IAC9F,aAAa,IAAI,4BAA4B,EAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;;GAIG;AACH,MAAM,WAAW,mCACf,SAAQ,IAAI,CAAC,6BAA6B,EAAE,YAAY,CAAC;IACzD,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C;AAED,MAAM;AACN,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,0BAA0B,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,IAAI,EAAE,uBAAuB,CAAC;IAE9B,+BAA+B,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD,4BAA4B,CAAC,CAC3B,OAAO,EAAE,sCAAsC,GAC9C,kCAAkC,CAAC;IAEtC,2BAA2B,CAAC,CAC1B,OAAO,EAAE,qCAAqC,GAC7C,iCAAiC,CAAC;IAErC,MAAM,CAAC,IAAI,uBAAuB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,8BAA8B,EAC9B,eAAe,EACf,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,kCAAkC,EAClC,iCAAiC,EACjC,6BAA6B,EAC7B,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,YAAY,EACZ,2BAA2B,EAC5B,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,mBAAmB,EACnB,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,8BAA8B,EAC9B,uBAAuB,EACvB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,EACN,mBAAmB,EACnB,kCAAkC,EAClC,6BAA6B,EAC7B,iCAAiC,EACjC,6BAA6B,EAC7B,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAElB;;;;;;;;GAQG;AACH,MAAM,WAAW,sCAAsC;IACrD,EAAE,EAAE,2BAA2B,CAAC;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,SAAS,EAAE,eAAe,CAAC;IAC3B,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,+BAA+B,CAAC;IAC9C,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,QAAQ,EAAE,gCAAgC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,eAAe,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,oCAAoC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,sBAAsB,EAAE,qCAAqC,CAAC;IAC9D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,eAAe,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,kCAAkC,CAAC;IAC7C,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,sBAAsB,EAAE,qCAAqC,CAAC;IAC9D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oCAAoC;IACnD,cAAc,EAAE,eAAe,CAAC;IAChC,iBAAiB,EAAE,eAAe,CAAC;IAEnC,iBAAiB,CAAC,EAAE,eAAe,CAAC;IAEpC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,eAAe,CAAC;IAChC,iBAAiB,EAAE,eAAe,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,eAAe,CAAC;IACpB,SAAS,EAAE,WAAW,CAAC;IAEvB,OAAO,EAAE,MAAM,CAAC;IAEhB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM;AACN,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,0BAA0B,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,IAAI,EAAE,uBAAuB,CAAC;IAE9B,+BAA+B,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD,4BAA4B,CAAC,CAC3B,OAAO,EAAE,sCAAsC,GAC9C,kCAAkC,CAAC;IAEtC,2BAA2B,CAAC,CAC1B,OAAO,EAAE,qCAAqC,GAC7C,iCAAiC,CAAC;IAErC,MAAM,IAAI,uBAAuB,CAAC;IAElC,qBAAqB,CAAC,IAAI,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAEzE,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/E,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzF,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAClF;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,KAAK,6BAA6B,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,wBAAwB,EAAE,eAAe,EAAE,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,yBAAyB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,UAAU,EAAE,mBAAmB,CAAC;IAChC,4GAA4G;IAC5G,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,wBAAwB,CAAC;IACrC,4GAA4G;IAC5G,IAAI,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,MAAM,EAAE,eAAe,CAAC;IACxB,wGAAwG;IACxG,wBAAwB,EAAE,eAAe,EAAE,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,UAAU,EAAE,oBAAoB,CAAC;IACjC,4GAA4G;IAC5G,IAAI,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,MAAM,EAAE,eAAe,CAAC;IACxB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,6GAA6G;IAC7G,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplewebauthn/server",
-  "version": "13.3.2",
+  "version": "14.0.0",
   "description": "SimpleWebAuthn for Servers",
   "keywords": [
     "typescript",

package/script/authentication/generateAuthenticationOptions.d.ts

@@ -1,4 +1,4 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorTransportFuture, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
 export type GenerateAuthenticationOptionsOpts = Parameters<typeof generateAuthenticationOptions>[0];
 /**
  * Prepare a value to pass into navigator.credentials.get(...) for authenticator authentication
@@ -16,7 +16,7 @@ export declare function generateAuthenticationOptions(options: {
     rpID: string;
     allowCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     challenge?: string | Uint8Array_;
     timeout?: number;

package/script/authentication/generateAuthenticationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,4BAA4B,EAC5B,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}
+{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}

package/script/authentication/verifyAuthenticationResponse.d.ts

@@ -26,6 +26,7 @@ export declare function verifyAuthenticationResponse(options: {
     expectedRPID: string | string[];
     credential: WebAuthnCredential;
     expectedType?: string | string[];
+    expectedTopOrigin?: string | string[];
     requireUserVerification?: boolean;
     advancedFIDOConfig?: {
         userVerification?: UserVerificationRequirement;

package/script/authentication/verifyAuthenticationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAmNzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}
+{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAgQzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}

package/script/authentication/verifyAuthenticationResponse.js

@@ -24,7 +24,7 @@ const index_js_1 = require("../helpers/iso/index.js");
  * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
  */
 async function verifyAuthenticationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, expectedTopOrigin, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
     const { id, rawId, type: credentialType, response: assertionResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -45,7 +45,7 @@ async function verifyAuthenticationResponse(options) {
         throw new Error('Credential response clientDataJSON was not a string');
     }
     const clientDataJSON = (0, decodeClientDataJSON_js_1.decodeClientDataJSON)(assertionResponse.clientDataJSON);
-    const { type, origin, challenge, tokenBinding } = clientDataJSON;
+    const { type, origin, challenge, tokenBinding, crossOrigin, topOrigin } = clientDataJSON;
     // Make sure we're handling an authentication
     if (Array.isArray(expectedType)) {
         if (!expectedType.includes(type)) {
@@ -70,6 +70,44 @@ async function verifyAuthenticationResponse(options) {
     else if (challenge !== expectedChallenge) {
         throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
     }
+    // Check that the authentication response is within an expected iframe
+    if (crossOrigin) {
+        /**
+         * TODO: Since Safari doesn't support `topOrigin` as of May 2026, only check this when
+         * `topOrigin` is available for now.
+         */
+        if (topOrigin) {
+            if (!expectedTopOrigin) {
+                /**
+                 * If `expectedTopOrigin` is not set, this should be considered an unexpected cross-origin
+                 * request. Reject the response while helping the RP understand how they need to update this
+                 * method call if they want to support verification of such WebAuthn authentication requests.
+                 */
+                throw new Error(`Detected cross-origin authentication response from top origin of "${topOrigin}", but a value for \`expectedTopOrigin\` was not specified when calling \`verifyAuthenticationResponse()\``);
+            }
+            if (Array.isArray(expectedTopOrigin)) {
+                if (!expectedTopOrigin.includes(topOrigin)) {
+                    const joinedExpectedTopOrigin = expectedTopOrigin.join(', ');
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected one of: ${joinedExpectedTopOrigin}`);
+                }
+            }
+            else {
+                if (topOrigin !== expectedTopOrigin) {
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected: ${expectedTopOrigin}`);
+                }
+            }
+        }
+    }
+    else {
+        if (topOrigin) {
+            /**
+             * If `topOrigin` is set despite `crossOrigin` being false, this is an unexpected request.
+             *
+             * See https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin.
+             */
+            throw new Error(`Unexpected top origin of "${topOrigin}" within a non-cross-origin authentication response. This error should be reported to the browser vendor as a WebAuthn specification violation with a link to https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin`);
+        }
+    }
     // Check that the origin is our site
     if (Array.isArray(expectedOrigin)) {
         if (!expectedOrigin.includes(origin)) {

package/script/helpers/cose.d.ts

@@ -48,6 +48,13 @@ export type COSEPublicKeyRSA = COSEPublicKey & {
     set(key: COSEKEYS.n, value: Uint8Array_): void;
     set(key: COSEKEYS.e, value: Uint8Array_): void;
 };
+/**
+ * Values specific for AKP (ML-DSA) public keys
+ */
+export type COSEPublicKeyAKP = COSEPublicKey & {
+    get(key: COSEKEYS.pub): Uint8Array_ | undefined;
+    set(key: COSEKEYS.pub, value: Uint8Array_): void;
+};
 /**
  * A type guard for determining if a COSE public key is an OKP key pair
  */
@@ -60,6 +67,10 @@ export declare function isCOSEPublicKeyEC2(cosePublicKey: COSEPublicKey): cosePu
  * A type guard for determining if a COSE public key is an RSA key pair
  */
 export declare function isCOSEPublicKeyRSA(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyRSA;
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+export declare function isCOSEPublicKeyAKP(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyAKP;
 /**
  * COSE Keys
  *
@@ -73,7 +84,8 @@ export declare enum COSEKEYS {
     x = -2,
     y = -3,
     n = -1,
-    e = -2
+    e = -2,
+    pub = -1
 }
 /**
  * COSE Key Types
@@ -83,7 +95,8 @@ export declare enum COSEKEYS {
 export declare enum COSEKTY {
     OKP = 1,
     EC2 = 2,
-    RSA = 3
+    RSA = 3,
+    AKP = 7
 }
 export declare function isCOSEKty(kty: number | undefined): kty is COSEKTY;
 /**
@@ -113,6 +126,9 @@ export declare enum COSEALG {
     PS384 = -38,
     PS512 = -39,
     ES256K = -47,
+    ML_DSA_44 = -48,
+    ML_DSA_65 = -49,
+    ML_DSA_87 = -50,
     RS256 = -257,
     RS384 = -258,
     RS512 = -259,

package/script/helpers/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;CACP;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}

package/script/helpers/cose.js

@@ -4,6 +4,7 @@ exports.COSEALG = exports.COSECRV = exports.COSEKTY = exports.COSEKEYS = void 0;
 exports.isCOSEPublicKeyOKP = isCOSEPublicKeyOKP;
 exports.isCOSEPublicKeyEC2 = isCOSEPublicKeyEC2;
 exports.isCOSEPublicKeyRSA = isCOSEPublicKeyRSA;
+exports.isCOSEPublicKeyAKP = isCOSEPublicKeyAKP;
 exports.isCOSEKty = isCOSEKty;
 exports.isCOSECrv = isCOSECrv;
 exports.isCOSEAlg = isCOSEAlg;
@@ -28,6 +29,13 @@ function isCOSEPublicKeyRSA(cosePublicKey) {
     const kty = cosePublicKey.get(COSEKEYS.kty);
     return isCOSEKty(kty) && kty === COSEKTY.RSA;
 }
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+function isCOSEPublicKeyAKP(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.AKP;
+}
 /**
  * COSE Keys
  *
@@ -43,6 +51,7 @@ var COSEKEYS;
     COSEKEYS[COSEKEYS["y"] = -3] = "y";
     COSEKEYS[COSEKEYS["n"] = -1] = "n";
     COSEKEYS[COSEKEYS["e"] = -2] = "e";
+    COSEKEYS[COSEKEYS["pub"] = -1] = "pub";
 })(COSEKEYS || (exports.COSEKEYS = COSEKEYS = {}));
 /**
  * COSE Key Types
@@ -54,6 +63,7 @@ var COSEKTY;
     COSEKTY[COSEKTY["OKP"] = 1] = "OKP";
     COSEKTY[COSEKTY["EC2"] = 2] = "EC2";
     COSEKTY[COSEKTY["RSA"] = 3] = "RSA";
+    COSEKTY[COSEKTY["AKP"] = 7] = "AKP";
 })(COSEKTY || (exports.COSEKTY = COSEKTY = {}));
 function isCOSEKty(kty) {
     return Object.values(COSEKTY).indexOf(kty) >= 0;
@@ -89,6 +99,9 @@ var COSEALG;
     COSEALG[COSEALG["PS384"] = -38] = "PS384";
     COSEALG[COSEALG["PS512"] = -39] = "PS512";
     COSEALG[COSEALG["ES256K"] = -47] = "ES256K";
+    COSEALG[COSEALG["ML_DSA_44"] = -48] = "ML_DSA_44";
+    COSEALG[COSEALG["ML_DSA_65"] = -49] = "ML_DSA_65";
+    COSEALG[COSEALG["ML_DSA_87"] = -50] = "ML_DSA_87";
     COSEALG[COSEALG["RS256"] = -257] = "RS256";
     COSEALG[COSEALG["RS384"] = -258] = "RS384";
     COSEALG[COSEALG["RS512"] = -259] = "RS512";

package/script/helpers/decodeClientDataJSON.d.ts

@@ -8,6 +8,7 @@ export type ClientDataJSON = {
     challenge: string;
     origin: string;
     crossOrigin?: boolean;
+    topOrigin?: string;
     tokenBinding?: {
         id?: string;
         status: 'present' | 'supported' | 'not-supported';

package/script/helpers/decodeClientDataJSON.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}
+{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}

package/script/helpers/index.d.ts

@@ -15,4 +15,6 @@ export * from './verifySignature.js';
 export * from './iso/index.js';
 export * from '../metadata/verifyMDSBlob.js';
 export * as cose from './cose.js';
+export { COSEALG } from './cose.js';
+export { type SimpleWebAuthnLogger } from './logging.js';
 //# sourceMappingURL=index.d.ts.map

package/script/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/script/helpers/index.js

@@ -26,7 +26,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cose = void 0;
+exports.COSEALG = exports.cose = void 0;
 __exportStar(require("./convertAAGUIDToString.js"), exports);
 __exportStar(require("./convertCertBufferToPEM.js"), exports);
 __exportStar(require("./convertCOSEtoPKCS.js"), exports);
@@ -44,3 +44,6 @@ __exportStar(require("./verifySignature.js"), exports);
 __exportStar(require("./iso/index.js"), exports);
 __exportStar(require("../metadata/verifyMDSBlob.js"), exports);
 exports.cose = __importStar(require("./cose.js"));
+// Specially exporting this for easier `supportedAlgorithmIDs` argument definition
+var cose_js_1 = require("./cose.js");
+Object.defineProperty(exports, "COSEALG", { enumerable: true, get: function () { return cose_js_1.COSEALG; } });

package/script/helpers/iso/isoCrypto/digest.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.digest = digest;
-const mapCoseAlgToWebCryptoAlg_js_1 = require("./mapCoseAlgToWebCryptoAlg.js");
+const mapCoseAlgToWebCryptoHashAlgName_js_1 = require("./mapCoseAlgToWebCryptoHashAlgName.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 /**
  * Generate a digest of the provided data.
@@ -11,7 +11,7 @@ const getWebCrypto_js_1 = require("./getWebCrypto.js");
  */
 async function digest(data, algorithm) {
     const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
-    const subtleAlgorithm = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(algorithm);
+    const subtleAlgorithm = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(algorithm);
     const hashed = await WebCrypto.subtle.digest(subtleAlgorithm, data);
     return new Uint8Array(hashed);
 }

package/script/helpers/iso/isoCrypto/getWebCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
+{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CA4C9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}

package/script/helpers/iso/isoCrypto/getWebCrypto.js

@@ -28,6 +28,18 @@ function getWebCrypto() {
          */
         const _globalThisCrypto = exports._getWebCryptoInternals.stubThisGlobalThisCrypto();
         if (_globalThisCrypto) {
+            /**
+             * In Deno v2.7.x, TypeScript 5.9 defines `Crypto.getRandomValues()` as the following type:
+             *
+             * `getRandomValues<T extends ArrayBufferView>(array: T): T;`
+             *
+             * However in earlier versions of TypeScript, `Crypto.getRandomValues()` is defined as such:
+             *
+             * `getRandomValues<T extends ArrayBufferView | null>(array: T): T;`
+             *
+             * Casting to `as unknown as Crypto` here (using this project's `Crypto` types extracted from
+             * DOM types in an older, minimum-supported-Deno version of TypeScript) helps bridge the gap.
+             */
             webCrypto = _globalThisCrypto;
             return resolve(webCrypto);
         }

package/script/helpers/iso/isoCrypto/importJWKKey.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+export declare function importJWKKey(opts: {
+    keyData: JsonWebKey;
+    algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams;
+}): Promise<CryptoKey>;
+//# sourceMappingURL=importJWKKey.d.ts.map

package/script/helpers/iso/isoCrypto/importJWKKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importJWKKey.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/importJWKKey.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,iBAAiB,CAAC;CAC5E,GAAG,OAAO,CAAC,SAAS,CAAC,CAMrB"}