@simplewebauthn/server 13.3.3 → 14.0.0

package/README.md

@@ -5,8 +5,8 @@
 [![JSR](https://jsr.io/badges/@simplewebauthn/server?style=for-the-badge)](https://jsr.io/@simplewebauthn/server)
 
 - [Installation](#installation)
-  - [Node LTS 20.x and higher](#node-lts-20x-and-higher)
-  - [Deno v1.43 and higher](#deno-v143-and-higher)
+  - [Node LTS 22.x and higher](#node-lts-22x-and-higher)
+  - [Deno v2.4.x and higher](#deno-v24x-and-higher)
 - [Documentation](#documentation)
 - [Supported Attestation Formats](#supported-attestation-formats)
 
@@ -15,18 +15,22 @@
 This package can be installed from **[NPM](https://www.npmjs.com/package/@simplewebauthn/server)**
 and **[JSR](https://jsr.io/@simplewebauthn/server)**:
 
-### Node LTS 20.x and higher
+### Node LTS 22.x and higher
 
 ```sh
 npm install @simplewebauthn/server
 ```
 
-### Deno v1.43 and higher
+> NOTE: This project will aim to support Node LTS releases through their Active and Maintenance windows as tracked on [the Node.js Releases page](https://nodejs.org/en/about/previous-releases).
+
+### Deno v2.4.x and higher
 
 ```sh
 deno add jsr:@simplewebauthn/server
 ```
 
+> NOTE: [Deno no longer has LTS releases to track after April 30, 2026](https://docs.deno.com/runtime/fundamentals/stability_and_releases/#long-term-support-(lts)). This project will aim to support Deno minor releases for up to one year after their release.
+
 ## Documentation
 
 You can find in-depth documentation on this package here:

package/esm/authentication/generateAuthenticationOptions.d.ts

@@ -1,4 +1,4 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorTransportFuture, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
 export type GenerateAuthenticationOptionsOpts = Parameters<typeof generateAuthenticationOptions>[0];
 /**
  * Prepare a value to pass into navigator.credentials.get(...) for authenticator authentication
@@ -16,7 +16,7 @@ export declare function generateAuthenticationOptions(options: {
     rpID: string;
     allowCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     challenge?: string | Uint8Array_;
     timeout?: number;

package/esm/authentication/generateAuthenticationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,4BAA4B,EAC5B,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}
+{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}

package/esm/authentication/verifyAuthenticationResponse.d.ts

@@ -26,6 +26,7 @@ export declare function verifyAuthenticationResponse(options: {
     expectedRPID: string | string[];
     credential: WebAuthnCredential;
     expectedType?: string | string[];
+    expectedTopOrigin?: string | string[];
     requireUserVerification?: boolean;
     advancedFIDOConfig?: {
         userVerification?: UserVerificationRequirement;

package/esm/authentication/verifyAuthenticationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAmNzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}
+{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAgQzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}

package/esm/authentication/verifyAuthenticationResponse.js

@@ -21,7 +21,7 @@ import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
  * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
  */
 export async function verifyAuthenticationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, expectedTopOrigin, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
     const { id, rawId, type: credentialType, response: assertionResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -42,7 +42,7 @@ export async function verifyAuthenticationResponse(options) {
         throw new Error('Credential response clientDataJSON was not a string');
     }
     const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
-    const { type, origin, challenge, tokenBinding } = clientDataJSON;
+    const { type, origin, challenge, tokenBinding, crossOrigin, topOrigin } = clientDataJSON;
     // Make sure we're handling an authentication
     if (Array.isArray(expectedType)) {
         if (!expectedType.includes(type)) {
@@ -67,6 +67,44 @@ export async function verifyAuthenticationResponse(options) {
     else if (challenge !== expectedChallenge) {
         throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
     }
+    // Check that the authentication response is within an expected iframe
+    if (crossOrigin) {
+        /**
+         * TODO: Since Safari doesn't support `topOrigin` as of May 2026, only check this when
+         * `topOrigin` is available for now.
+         */
+        if (topOrigin) {
+            if (!expectedTopOrigin) {
+                /**
+                 * If `expectedTopOrigin` is not set, this should be considered an unexpected cross-origin
+                 * request. Reject the response while helping the RP understand how they need to update this
+                 * method call if they want to support verification of such WebAuthn authentication requests.
+                 */
+                throw new Error(`Detected cross-origin authentication response from top origin of "${topOrigin}", but a value for \`expectedTopOrigin\` was not specified when calling \`verifyAuthenticationResponse()\``);
+            }
+            if (Array.isArray(expectedTopOrigin)) {
+                if (!expectedTopOrigin.includes(topOrigin)) {
+                    const joinedExpectedTopOrigin = expectedTopOrigin.join(', ');
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected one of: ${joinedExpectedTopOrigin}`);
+                }
+            }
+            else {
+                if (topOrigin !== expectedTopOrigin) {
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected: ${expectedTopOrigin}`);
+                }
+            }
+        }
+    }
+    else {
+        if (topOrigin) {
+            /**
+             * If `topOrigin` is set despite `crossOrigin` being false, this is an unexpected request.
+             *
+             * See https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin.
+             */
+            throw new Error(`Unexpected top origin of "${topOrigin}" within a non-cross-origin authentication response. This error should be reported to the browser vendor as a WebAuthn specification violation with a link to https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin`);
+        }
+    }
     // Check that the origin is our site
     if (Array.isArray(expectedOrigin)) {
         if (!expectedOrigin.includes(origin)) {

package/esm/helpers/cose.d.ts

@@ -48,6 +48,13 @@ export type COSEPublicKeyRSA = COSEPublicKey & {
     set(key: COSEKEYS.n, value: Uint8Array_): void;
     set(key: COSEKEYS.e, value: Uint8Array_): void;
 };
+/**
+ * Values specific for AKP (ML-DSA) public keys
+ */
+export type COSEPublicKeyAKP = COSEPublicKey & {
+    get(key: COSEKEYS.pub): Uint8Array_ | undefined;
+    set(key: COSEKEYS.pub, value: Uint8Array_): void;
+};
 /**
  * A type guard for determining if a COSE public key is an OKP key pair
  */
@@ -60,6 +67,10 @@ export declare function isCOSEPublicKeyEC2(cosePublicKey: COSEPublicKey): cosePu
  * A type guard for determining if a COSE public key is an RSA key pair
  */
 export declare function isCOSEPublicKeyRSA(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyRSA;
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+export declare function isCOSEPublicKeyAKP(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyAKP;
 /**
  * COSE Keys
  *
@@ -73,7 +84,8 @@ export declare enum COSEKEYS {
     x = -2,
     y = -3,
     n = -1,
-    e = -2
+    e = -2,
+    pub = -1
 }
 /**
  * COSE Key Types
@@ -83,7 +95,8 @@ export declare enum COSEKEYS {
 export declare enum COSEKTY {
     OKP = 1,
     EC2 = 2,
-    RSA = 3
+    RSA = 3,
+    AKP = 7
 }
 export declare function isCOSEKty(kty: number | undefined): kty is COSEKTY;
 /**
@@ -113,6 +126,9 @@ export declare enum COSEALG {
     PS384 = -38,
     PS512 = -39,
     ES256K = -47,
+    ML_DSA_44 = -48,
+    ML_DSA_65 = -49,
+    ML_DSA_87 = -50,
     RS256 = -257,
     RS384 = -258,
     RS512 = -259,

package/esm/helpers/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;CACP;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}

package/esm/helpers/cose.js

@@ -19,6 +19,13 @@ export function isCOSEPublicKeyRSA(cosePublicKey) {
     const kty = cosePublicKey.get(COSEKEYS.kty);
     return isCOSEKty(kty) && kty === COSEKTY.RSA;
 }
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+export function isCOSEPublicKeyAKP(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.AKP;
+}
 /**
  * COSE Keys
  *
@@ -34,6 +41,7 @@ export var COSEKEYS;
     COSEKEYS[COSEKEYS["y"] = -3] = "y";
     COSEKEYS[COSEKEYS["n"] = -1] = "n";
     COSEKEYS[COSEKEYS["e"] = -2] = "e";
+    COSEKEYS[COSEKEYS["pub"] = -1] = "pub";
 })(COSEKEYS || (COSEKEYS = {}));
 /**
  * COSE Key Types
@@ -45,6 +53,7 @@ export var COSEKTY;
     COSEKTY[COSEKTY["OKP"] = 1] = "OKP";
     COSEKTY[COSEKTY["EC2"] = 2] = "EC2";
     COSEKTY[COSEKTY["RSA"] = 3] = "RSA";
+    COSEKTY[COSEKTY["AKP"] = 7] = "AKP";
 })(COSEKTY || (COSEKTY = {}));
 export function isCOSEKty(kty) {
     return Object.values(COSEKTY).indexOf(kty) >= 0;
@@ -80,6 +89,9 @@ export var COSEALG;
     COSEALG[COSEALG["PS384"] = -38] = "PS384";
     COSEALG[COSEALG["PS512"] = -39] = "PS512";
     COSEALG[COSEALG["ES256K"] = -47] = "ES256K";
+    COSEALG[COSEALG["ML_DSA_44"] = -48] = "ML_DSA_44";
+    COSEALG[COSEALG["ML_DSA_65"] = -49] = "ML_DSA_65";
+    COSEALG[COSEALG["ML_DSA_87"] = -50] = "ML_DSA_87";
     COSEALG[COSEALG["RS256"] = -257] = "RS256";
     COSEALG[COSEALG["RS384"] = -258] = "RS384";
     COSEALG[COSEALG["RS512"] = -259] = "RS512";

package/esm/helpers/decodeClientDataJSON.d.ts

@@ -8,6 +8,7 @@ export type ClientDataJSON = {
     challenge: string;
     origin: string;
     crossOrigin?: boolean;
+    topOrigin?: string;
     tokenBinding?: {
         id?: string;
         status: 'present' | 'supported' | 'not-supported';

package/esm/helpers/decodeClientDataJSON.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}
+{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}

package/esm/helpers/index.d.ts

@@ -15,4 +15,6 @@ export * from './verifySignature.js';
 export * from './iso/index.js';
 export * from '../metadata/verifyMDSBlob.js';
 export * as cose from './cose.js';
+export { COSEALG } from './cose.js';
+export { type SimpleWebAuthnLogger } from './logging.js';
 //# sourceMappingURL=index.d.ts.map

package/esm/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/esm/helpers/index.js

@@ -15,3 +15,5 @@ export * from './verifySignature.js';
 export * from './iso/index.js';
 export * from '../metadata/verifyMDSBlob.js';
 export * as cose from './cose.js';
+// Specially exporting this for easier `supportedAlgorithmIDs` argument definition
+export { COSEALG } from './cose.js';

package/esm/helpers/iso/isoCrypto/digest.js

@@ -1,4 +1,4 @@
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
 import { getWebCrypto } from './getWebCrypto.js';
 /**
  * Generate a digest of the provided data.
@@ -8,7 +8,7 @@ import { getWebCrypto } from './getWebCrypto.js';
  */
 export async function digest(data, algorithm) {
     const WebCrypto = await getWebCrypto();
-    const subtleAlgorithm = mapCoseAlgToWebCryptoAlg(algorithm);
+    const subtleAlgorithm = mapCoseAlgToWebCryptoHashAlgName(algorithm);
     const hashed = await WebCrypto.subtle.digest(subtleAlgorithm, data);
     return new Uint8Array(hashed);
 }

package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
+{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CA4C9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}

package/esm/helpers/iso/isoCrypto/getWebCrypto.js

@@ -24,6 +24,18 @@ export function getWebCrypto() {
          */
         const _globalThisCrypto = _getWebCryptoInternals.stubThisGlobalThisCrypto();
         if (_globalThisCrypto) {
+            /**
+             * In Deno v2.7.x, TypeScript 5.9 defines `Crypto.getRandomValues()` as the following type:
+             *
+             * `getRandomValues<T extends ArrayBufferView>(array: T): T;`
+             *
+             * However in earlier versions of TypeScript, `Crypto.getRandomValues()` is defined as such:
+             *
+             * `getRandomValues<T extends ArrayBufferView | null>(array: T): T;`
+             *
+             * Casting to `as unknown as Crypto` here (using this project's `Crypto` types extracted from
+             * DOM types in an older, minimum-supported-Deno version of TypeScript) helps bridge the gap.
+             */
             webCrypto = _globalThisCrypto;
             return resolve(webCrypto);
         }

package/esm/helpers/iso/isoCrypto/importJWKKey.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+export declare function importJWKKey(opts: {
+    keyData: JsonWebKey;
+    algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams;
+}): Promise<CryptoKey>;
+//# sourceMappingURL=importJWKKey.d.ts.map

package/esm/helpers/iso/isoCrypto/importJWKKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importJWKKey.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/importJWKKey.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,iBAAiB,CAAC;CAC5E,GAAG,OAAO,CAAC,SAAS,CAAC,CAMrB"}

package/esm/helpers/iso/isoCrypto/{importKey.js → importJWKKey.js}

@@ -1,8 +1,10 @@
 import { getWebCrypto } from './getWebCrypto.js';
-export async function importKey(opts) {
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+export async function importJWKKey(opts) {
     const WebCrypto = await getWebCrypto();
     const { keyData, algorithm } = opts;
-    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, [
-        'verify',
-    ]);
+    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, ['verify']);
 }

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts

@@ -0,0 +1,10 @@
+import type { SubtleCryptoAlg } from './structs.js';
+import { COSEALG } from '../../cose.js';
+/**
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
+ */
+export declare function mapCoseAlgToWebCryptoHashAlgName(alg: COSEALG): SubtleCryptoAlg;
+//# sourceMappingURL=mapCoseAlgToWebCryptoHashAlgName.d.ts.map

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCoseAlgToWebCryptoHashAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAe9E"}

package/esm/helpers/iso/isoCrypto/{mapCoseAlgToWebCryptoAlg.js → mapCoseAlgToWebCryptoHashAlgName.js}

@@ -1,8 +1,11 @@
 import { COSEALG } from '../../cose.js';
 /**
- * Convert a COSE alg ID into a corresponding string value that WebCrypto APIs expect
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
-export function mapCoseAlgToWebCryptoAlg(alg) {
+export function mapCoseAlgToWebCryptoHashAlgName(alg) {
     if ([COSEALG.RS1].indexOf(alg) >= 0) {
         return 'SHA-1';
     }
@@ -16,5 +19,5 @@ export function mapCoseAlgToWebCryptoAlg(alg) {
         0) {
         return 'SHA-512';
     }
-    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`);
+    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto hash alg name`);
 }

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts

@@ -1,7 +1,10 @@
 import { COSEALG } from '../../cose.js';
-import { SubtleCryptoKeyAlgName } from './structs.js';
+import type { SubtleCryptoKeyAlgName } from './structs.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export declare function mapCoseAlgToWebCryptoKeyAlgName(alg: COSEALG): SubtleCryptoKeyAlgName;
 //# sourceMappingURL=mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAoBxB"}
+{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAuBxB"}

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js

@@ -1,6 +1,9 @@
 import { COSEALG } from '../../cose.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     if ([COSEALG.EdDSA].indexOf(alg) >= 0) {
@@ -15,5 +18,17 @@ export function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     else if ([COSEALG.PS256, COSEALG.PS384, COSEALG.PS512].indexOf(alg) >= 0) {
         return 'RSA-PSS';
     }
+    else if ([COSEALG.ML_DSA_44].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-44';
+    }
+    else if ([COSEALG.ML_DSA_65].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-65';
+    }
+    else if ([COSEALG.ML_DSA_87].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-87';
+    }
     throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`);
 }

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts

@@ -0,0 +1,7 @@
+import type { AlgorithmIdentifier } from '../../../types/index.js';
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export declare function runtimeSupportsWebCryptoKeyAlg(alg: AlgorithmIdentifier): boolean;
+//# sourceMappingURL=runtimeSupportsWebCryptoKeyAlg.d.ts.map

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSupportsWebCryptoKeyAlg.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;AAEvF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAYhF"}

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js

@@ -0,0 +1,16 @@
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export function runtimeSupportsWebCryptoKeyAlg(alg) {
+    const globalSubtleCrypto = globalThis.SubtleCrypto;
+    if (typeof globalSubtleCrypto.supports !== 'function') {
+        return false;
+    }
+    try {
+        return globalSubtleCrypto.supports('verify', alg);
+    }
+    catch (_err) {
+        return false;
+    }
+}

package/esm/helpers/iso/isoCrypto/structs.d.ts

@@ -1,4 +1,4 @@
 export type SubtleCryptoAlg = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 export type SubtleCryptoCrv = 'P-256' | 'P-384' | 'P-521' | 'Ed25519';
-export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
+export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
 //# sourceMappingURL=structs.d.ts.map

package/esm/helpers/iso/isoCrypto/structs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,SAAS,CAAC"}
+{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,WAAW,GACX,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,SAAS,CAAC"}

package/esm/helpers/iso/isoCrypto/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAMnB,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BnB"}

package/esm/helpers/iso/isoCrypto/verify.js

@@ -1,4 +1,5 @@
-import { COSEKEYS, isCOSECrv, isCOSEPublicKeyEC2, isCOSEPublicKeyOKP, isCOSEPublicKeyRSA, } from '../../cose.js';
+import { COSEKEYS, isCOSECrv, isCOSEPublicKeyAKP, isCOSEPublicKeyEC2, isCOSEPublicKeyOKP, isCOSEPublicKeyRSA, } from '../../cose.js';
+import { verifyAKP } from './verifyAKP.js';
 import { verifyEC2 } from './verifyEC2.js';
 import { verifyRSA } from './verifyRSA.js';
 import { verifyOKP } from './verifyOKP.js';
@@ -27,6 +28,9 @@ export function verify(opts) {
     else if (isCOSEPublicKeyOKP(cosePublicKey)) {
         return verifyOKP({ cosePublicKey, signature, data });
     }
+    else if (isCOSEPublicKeyAKP(cosePublicKey)) {
+        return verifyAKP({ cosePublicKey, signature, data });
+    }
     const kty = cosePublicKey.get(COSEKEYS.kty);
     throw new Error(`Signature verification with public key of kty ${kty} is not supported by this method`);
 }

package/esm/helpers/iso/isoCrypto/verifyAKP.d.ts

@@ -0,0 +1,9 @@
+import { type COSEPublicKeyAKP } from '../../cose.js';
+import type { Uint8Array_ } from '../../../types/index.js';
+/** AKP, a.k.a ML-DSA */
+export declare function verifyAKP(opts: {
+    cosePublicKey: COSEPublicKeyAKP;
+    signature: Uint8Array_;
+    data: Uint8Array_;
+}): Promise<boolean>;
+//# sourceMappingURL=verifyAKP.d.ts.map

package/esm/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAK3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB"}

package/esm/helpers/iso/isoCrypto/verifyAKP.js

@@ -0,0 +1,47 @@
+import { COSEKEYS, isCOSEAlg } from '../../cose.js';
+import { isoBase64URL } from '../../index.js';
+import { importJWKKey } from './importJWKKey.js';
+import { getWebCrypto } from './getWebCrypto.js';
+import { mapCoseAlgToWebCryptoKeyAlgName } from './mapCoseAlgToWebCryptoKeyAlgName.js';
+/** AKP, a.k.a ML-DSA */
+export async function verifyAKP(opts) {
+    const { cosePublicKey, signature, data } = opts;
+    const WebCrypto = await getWebCrypto();
+    const alg = cosePublicKey.get(COSEKEYS.alg);
+    const pub = cosePublicKey.get(COSEKEYS.pub);
+    if (!alg) {
+        throw new Error('Public key was missing alg (AKP)');
+    }
+    if (!isCOSEAlg(alg)) {
+        throw new Error(`Public key had invalid alg ${alg} (AKP)`);
+    }
+    if (!pub) {
+        throw new Error('Public key was missing pub (AKP)');
+    }
+    const webCryptoAlg = mapCoseAlgToWebCryptoKeyAlgName(alg);
+    // See https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-operations-import-key -> "jwk"
+    const keyData = {
+        kty: 'AKP',
+        alg: webCryptoAlg,
+        pub: isoBase64URL.fromBuffer(pub),
+        ext: false,
+    };
+    /**
+     * ML-DSA support is pretty cutting edge, so take some steps to help RP's understand this instead
+     * of them getting a `NotSupportedError: Unrecognized algorithm name` and trying to interpret it.
+     */
+    let key;
+    try {
+        key = await importJWKKey({ keyData, algorithm: webCryptoAlg });
+    }
+    catch (err) {
+        const _err = err;
+        if (_err.name === 'NotSupportedError') {
+            throw new Error(`This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}. See the \`cause\` property of this error for more info`, { cause: err });
+        }
+        else {
+            throw err;
+        }
+    }
+    return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
+}

package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
+{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAuEnB"}

package/esm/helpers/iso/isoCrypto/verifyEC2.js

@@ -1,6 +1,6 @@
 import { COSECRV, COSEKEYS } from '../../cose.js';
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
-import { importKey } from './importKey.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
+import { importJWKKey } from './importJWKKey.js';
 import { isoBase64URL } from '../index.js';
 import { getWebCrypto } from './getWebCrypto.js';
 /**
@@ -56,14 +56,11 @@ export async function verifyEC2(opts) {
         name: 'ECDSA',
         namedCurve: _crv,
     };
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     // Determine which SHA algorithm to use for signature verification
-    let subtleAlg = mapCoseAlgToWebCryptoAlg(alg);
+    let subtleAlg = mapCoseAlgToWebCryptoHashAlgName(alg);
     if (shaHashOverride) {
-        subtleAlg = mapCoseAlgToWebCryptoAlg(shaHashOverride);
+        subtleAlg = mapCoseAlgToWebCryptoHashAlgName(shaHashOverride);
     }
     const verifyAlgorithm = {
         name: 'ECDSA',

package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
+{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsDnB"}