@simplewebauthn/server 13.3.3 → 14.0.1

package/README.md

@@ -5,8 +5,8 @@
 [![JSR](https://jsr.io/badges/@simplewebauthn/server?style=for-the-badge)](https://jsr.io/@simplewebauthn/server)
 
 - [Installation](#installation)
-  - [Node LTS 20.x and higher](#node-lts-20x-and-higher)
-  - [Deno v1.43 and higher](#deno-v143-and-higher)
+  - [Node LTS 22.x and higher](#node-lts-22x-and-higher)
+  - [Deno v2.4.x and higher](#deno-v24x-and-higher)
 - [Documentation](#documentation)
 - [Supported Attestation Formats](#supported-attestation-formats)
 
@@ -15,18 +15,22 @@
 This package can be installed from **[NPM](https://www.npmjs.com/package/@simplewebauthn/server)**
 and **[JSR](https://jsr.io/@simplewebauthn/server)**:
 
-### Node LTS 20.x and higher
+### Node LTS 22.x and higher
 
 ```sh
 npm install @simplewebauthn/server
 ```
 
-### Deno v1.43 and higher
+> NOTE: This project will aim to support Node LTS releases through their Active and Maintenance windows as tracked on [the Node.js Releases page](https://nodejs.org/en/about/previous-releases).
+
+### Deno v2.4.x and higher
 
 ```sh
 deno add jsr:@simplewebauthn/server
 ```
 
+> NOTE: [Deno no longer has LTS releases to track after April 30, 2026](https://docs.deno.com/runtime/fundamentals/stability_and_releases/#long-term-support-(lts)). This project will aim to support Deno minor releases for up to one year after their release.
+
 ## Documentation
 
 You can find in-depth documentation on this package here:

package/esm/authentication/generateAuthenticationOptions.d.ts

@@ -1,4 +1,4 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorTransportFuture, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, Base64URLString, PublicKeyCredentialRequestOptionsJSON, Uint8Array_ } from '../types/index.js';
 export type GenerateAuthenticationOptionsOpts = Parameters<typeof generateAuthenticationOptions>[0];
 /**
  * Prepare a value to pass into navigator.credentials.get(...) for authenticator authentication
@@ -16,7 +16,7 @@ export declare function generateAuthenticationOptions(options: {
     rpID: string;
     allowCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     challenge?: string | Uint8Array_;
     timeout?: number;

package/esm/authentication/generateAuthenticationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,4BAA4B,EAC5B,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}
+{"version":3,"file":"generateAuthenticationOptions.d.ts","sourceRoot":"","sources":["../../src/authentication/generateAuthenticationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,eAAe,EACf,qCAAqC,EACrC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D,UAAU,CAAC,EAAE,oCAAoC,CAAC;CACnD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAoChD"}

package/esm/authentication/verifyAuthenticationResponse.d.ts

@@ -26,6 +26,7 @@ export declare function verifyAuthenticationResponse(options: {
     expectedRPID: string | string[];
     credential: WebAuthnCredential;
     expectedType?: string | string[];
+    expectedTopOrigin?: string | string[];
     requireUserVerification?: boolean;
     advancedFIDOConfig?: {
         userVerification?: UserVerificationRequirement;

package/esm/authentication/verifyAuthenticationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAmNzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}
+{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAQhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CA6QzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}

package/esm/authentication/verifyAuthenticationResponse.js

@@ -5,6 +5,10 @@ import { parseAuthenticatorData } from '../helpers/parseAuthenticatorData.js';
 import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
 import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
 import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+import { decodeCredentialPublicKey } from '../helpers/decodeCredentialPublicKey.js';
+import { COSEKEYS, isPQCCOSEAlg } from '../helpers/cose.js';
+import { SettingsService } from '../services/settingsService.js';
+import { PQCNotSupportedError } from '../errors/index.js';
 /**
  * Verify that the user has legitimately completed the authentication process
  *
@@ -21,7 +25,7 @@ import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
  * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
  */
 export async function verifyAuthenticationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, expectedTopOrigin, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
     const { id, rawId, type: credentialType, response: assertionResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -42,7 +46,7 @@ export async function verifyAuthenticationResponse(options) {
         throw new Error('Credential response clientDataJSON was not a string');
     }
     const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
-    const { type, origin, challenge, tokenBinding } = clientDataJSON;
+    const { type, origin, challenge, tokenBinding, crossOrigin, topOrigin } = clientDataJSON;
     // Make sure we're handling an authentication
     if (Array.isArray(expectedType)) {
         if (!expectedType.includes(type)) {
@@ -67,6 +71,44 @@ export async function verifyAuthenticationResponse(options) {
     else if (challenge !== expectedChallenge) {
         throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
     }
+    // Check that the authentication response is within an expected iframe
+    if (crossOrigin) {
+        /**
+         * TODO: Since Safari doesn't support `topOrigin` as of May 2026, only check this when
+         * `topOrigin` is available for now.
+         */
+        if (topOrigin) {
+            if (!expectedTopOrigin) {
+                /**
+                 * If `expectedTopOrigin` is not set, this should be considered an unexpected cross-origin
+                 * request. Reject the response while helping the RP understand how they need to update this
+                 * method call if they want to support verification of such WebAuthn authentication requests.
+                 */
+                throw new Error(`Detected cross-origin authentication response from top origin of "${topOrigin}", but a value for \`expectedTopOrigin\` was not specified when calling \`verifyAuthenticationResponse()\``);
+            }
+            if (Array.isArray(expectedTopOrigin)) {
+                if (!expectedTopOrigin.includes(topOrigin)) {
+                    const joinedExpectedTopOrigin = expectedTopOrigin.join(', ');
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected one of: ${joinedExpectedTopOrigin}`);
+                }
+            }
+            else {
+                if (topOrigin !== expectedTopOrigin) {
+                    throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected: ${expectedTopOrigin}`);
+                }
+            }
+        }
+    }
+    else {
+        if (topOrigin) {
+            /**
+             * If `topOrigin` is set despite `crossOrigin` being false, this is an unexpected request.
+             *
+             * See https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin.
+             */
+            throw new Error(`Unexpected top origin of "${topOrigin}" within a non-cross-origin authentication response. This error should be reported to the browser vendor as a WebAuthn specification violation with a link to https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin`);
+        }
+    }
     // Check that the origin is our site
     if (Array.isArray(expectedOrigin)) {
         if (!expectedOrigin.includes(origin)) {
@@ -149,6 +191,14 @@ export async function verifyAuthenticationResponse(options) {
         // on the device without going through this site
         throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
     }
+    const decodedPublicKey = decodeCredentialPublicKey(credential.publicKey);
+    const pubKeyAlg = decodedPublicKey.get(COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
+        throw new Error('Credential public key was missing numeric alg');
+    }
+    if (isPQCCOSEAlg(pubKeyAlg) && !SettingsService.runtimeSupportsPQC()) {
+        throw new PQCNotSupportedError(pubKeyAlg);
+    }
     const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
     const toReturn = {
         verified: await verifySignature({

package/esm/errors/index.d.ts

@@ -0,0 +1,17 @@
+import type { COSEALG } from '../helpers/cose.js';
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+export declare class SimpleWebAuthnError extends Error {
+    code: SimpleWebAuthnErrorCode;
+    constructor({ message, code, cause }: {
+        message: string;
+        code: SimpleWebAuthnErrorCode;
+        cause?: Error;
+    });
+}
+export declare class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg: COSEALG);
+}
+export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT';
+//# sourceMappingURL=index.d.ts.map

package/esm/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC"}

package/esm/errors/index.js

@@ -0,0 +1,24 @@
+import { mapCoseAlgToWebCryptoKeyAlgName } from '../helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js';
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+export class SimpleWebAuthnError extends Error {
+    constructor({ message, code, cause }) {
+        super(message, { cause });
+        Object.defineProperty(this, "code", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'SimpleWebAuthnError';
+        this.code = code;
+    }
+}
+export class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg) {
+        const webCryptoAlg = mapCoseAlgToWebCryptoKeyAlgName(alg);
+        const message = `This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}`;
+        super({ message, code: 'RUNTIME_NO_PQC_SUPPORT' });
+    }
+}

package/esm/helpers/convertX509PublicKeyToCOSE.d.ts

@@ -1,4 +1,4 @@
-import { COSEPublicKey } from './cose.js';
+import { type COSEPublicKey } from './cose.js';
 import type { Uint8Array_ } from '../types/index.js';
 export declare function convertX509PublicKeyToCOSE(x509Certificate: Uint8Array_): COSEPublicKey;
 //# sourceMappingURL=convertX509PublicKeyToCOSE.d.ts.map

package/esm/helpers/convertX509PublicKeyToCOSE.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,aAAa,EAGd,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CA+Ff"}
+{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CAsGf"}

package/esm/helpers/convertX509PublicKeyToCOSE.js

@@ -1,8 +1,9 @@
 import { AsnParser } from '@peculiar/asn1-schema';
 import { Certificate } from '@peculiar/asn1-x509';
 import { ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1 } from '@peculiar/asn1-ecc';
+import { id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87 } from '@peculiar/asn1-x509-post-quantum';
 import { id_rsaEncryption, RSAPublicKey } from '@peculiar/asn1-rsa';
-import { COSECRV, COSEKEYS, COSEKTY, } from './cose.js';
+import { COSEALG, COSECRV, COSEKEYS, COSEKTY, } from './cose.js';
 import { mapX509SignatureAlgToCOSEAlg } from './mapX509SignatureAlgToCOSEAlg.js';
 export function convertX509PublicKeyToCOSE(x509Certificate) {
     let cosePublicKey = new Map();
@@ -11,8 +12,7 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
      */
     const x509 = AsnParser.parse(x509Certificate, Certificate);
     const { tbsCertificate } = x509;
-    const { subjectPublicKeyInfo, signature: _tbsSignature } = tbsCertificate;
-    const signatureAlgorithm = _tbsSignature.algorithm;
+    const { subjectPublicKeyInfo } = tbsCertificate;
     const publicKeyAlgorithmID = subjectPublicKeyInfo.algorithm.algorithm;
     if (publicKeyAlgorithmID === id_ecPublicKey) {
         /**
@@ -22,12 +22,15 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
             throw new Error('Certificate public key was missing parameters (EC2)');
         }
         const ecParameters = AsnParser.parse(new Uint8Array(subjectPublicKeyInfo.algorithm.parameters), ECParameters);
-        let crv = -999;
+        let alg;
+        let crv;
         const { namedCurve } = ecParameters;
         if (namedCurve === id_secp256r1) {
+            alg = COSEALG.ES256;
             crv = COSECRV.P256;
         }
         else if (namedCurve === id_secp384r1) {
+            alg = COSEALG.ES384;
             crv = COSECRV.P384;
         }
         else {
@@ -48,7 +51,7 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
         }
         const coseEC2PubKey = new Map();
         coseEC2PubKey.set(COSEKEYS.kty, COSEKTY.EC2);
-        coseEC2PubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        coseEC2PubKey.set(COSEKEYS.alg, alg);
         coseEC2PubKey.set(COSEKEYS.crv, crv);
         coseEC2PubKey.set(COSEKEYS.x, x);
         coseEC2PubKey.set(COSEKEYS.y, y);
@@ -61,11 +64,24 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
         const rsaPublicKey = AsnParser.parse(subjectPublicKeyInfo.subjectPublicKey, RSAPublicKey);
         const coseRSAPubKey = new Map();
         coseRSAPubKey.set(COSEKEYS.kty, COSEKTY.RSA);
-        coseRSAPubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        /**
+         * The algorithm ID is too ambiguous to know what this alg should really be. But practically
+         * speaking `shaHashOverride` is always specified when verifying signatures with RSA public keys
+         * which ultimately overrides this sensible default. Using RS256 also gets the correct WebCrypto
+         * alg name later on in verifyRSA.ts
+         */
+        coseRSAPubKey.set(COSEKEYS.alg, COSEALG.RS256);
         coseRSAPubKey.set(COSEKEYS.n, new Uint8Array(rsaPublicKey.modulus));
         coseRSAPubKey.set(COSEKEYS.e, new Uint8Array(rsaPublicKey.publicExponent));
         cosePublicKey = coseRSAPubKey;
     }
+    else if ([id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87].indexOf(publicKeyAlgorithmID) >= 0) {
+        const coseAKPPubKey = new Map();
+        coseAKPPubKey.set(COSEKEYS.kty, COSEKTY.AKP);
+        coseAKPPubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(publicKeyAlgorithmID));
+        coseAKPPubKey.set(COSEKEYS.pub, new Uint8Array(subjectPublicKeyInfo.subjectPublicKey));
+        cosePublicKey = coseAKPPubKey;
+    }
     else {
         throw new Error(`Certificate public key contained unexpected algorithm ID ${publicKeyAlgorithmID}`);
     }

package/esm/helpers/cose.d.ts

@@ -48,6 +48,13 @@ export type COSEPublicKeyRSA = COSEPublicKey & {
     set(key: COSEKEYS.n, value: Uint8Array_): void;
     set(key: COSEKEYS.e, value: Uint8Array_): void;
 };
+/**
+ * Values specific for AKP (ML-DSA) public keys
+ */
+export type COSEPublicKeyAKP = COSEPublicKey & {
+    get(key: COSEKEYS.pub): Uint8Array_ | undefined;
+    set(key: COSEKEYS.pub, value: Uint8Array_): void;
+};
 /**
  * A type guard for determining if a COSE public key is an OKP key pair
  */
@@ -60,6 +67,10 @@ export declare function isCOSEPublicKeyEC2(cosePublicKey: COSEPublicKey): cosePu
  * A type guard for determining if a COSE public key is an RSA key pair
  */
 export declare function isCOSEPublicKeyRSA(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyRSA;
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+export declare function isCOSEPublicKeyAKP(cosePublicKey: COSEPublicKey): cosePublicKey is COSEPublicKeyAKP;
 /**
  * COSE Keys
  *
@@ -73,7 +84,8 @@ export declare enum COSEKEYS {
     x = -2,
     y = -3,
     n = -1,
-    e = -2
+    e = -2,
+    pub = -1
 }
 /**
  * COSE Key Types
@@ -83,7 +95,8 @@ export declare enum COSEKEYS {
 export declare enum COSEKTY {
     OKP = 1,
     EC2 = 2,
-    RSA = 3
+    RSA = 3,
+    AKP = 7
 }
 export declare function isCOSEKty(kty: number | undefined): kty is COSEKTY;
 /**
@@ -113,10 +126,14 @@ export declare enum COSEALG {
     PS384 = -38,
     PS512 = -39,
     ES256K = -47,
+    ML_DSA_44 = -48,
+    ML_DSA_65 = -49,
+    ML_DSA_87 = -50,
     RS256 = -257,
     RS384 = -258,
     RS512 = -259,
     RS1 = -65535
 }
 export declare function isCOSEAlg(alg: number | undefined): alg is COSEALG;
+export declare function isPQCCOSEAlg(alg: COSEALG): boolean;
 //# sourceMappingURL=cose.d.ts.map

package/esm/helpers/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;CACP;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD"}

package/esm/helpers/cose.js

@@ -19,6 +19,13 @@ export function isCOSEPublicKeyRSA(cosePublicKey) {
     const kty = cosePublicKey.get(COSEKEYS.kty);
     return isCOSEKty(kty) && kty === COSEKTY.RSA;
 }
+/**
+ * A type guard for determining if a COSE public key is an AKP key pair
+ */
+export function isCOSEPublicKeyAKP(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.AKP;
+}
 /**
  * COSE Keys
  *
@@ -34,6 +41,7 @@ export var COSEKEYS;
     COSEKEYS[COSEKEYS["y"] = -3] = "y";
     COSEKEYS[COSEKEYS["n"] = -1] = "n";
     COSEKEYS[COSEKEYS["e"] = -2] = "e";
+    COSEKEYS[COSEKEYS["pub"] = -1] = "pub";
 })(COSEKEYS || (COSEKEYS = {}));
 /**
  * COSE Key Types
@@ -45,6 +53,7 @@ export var COSEKTY;
     COSEKTY[COSEKTY["OKP"] = 1] = "OKP";
     COSEKTY[COSEKTY["EC2"] = 2] = "EC2";
     COSEKTY[COSEKTY["RSA"] = 3] = "RSA";
+    COSEKTY[COSEKTY["AKP"] = 7] = "AKP";
 })(COSEKTY || (COSEKTY = {}));
 export function isCOSEKty(kty) {
     return Object.values(COSEKTY).indexOf(kty) >= 0;
@@ -80,6 +89,9 @@ export var COSEALG;
     COSEALG[COSEALG["PS384"] = -38] = "PS384";
     COSEALG[COSEALG["PS512"] = -39] = "PS512";
     COSEALG[COSEALG["ES256K"] = -47] = "ES256K";
+    COSEALG[COSEALG["ML_DSA_44"] = -48] = "ML_DSA_44";
+    COSEALG[COSEALG["ML_DSA_65"] = -49] = "ML_DSA_65";
+    COSEALG[COSEALG["ML_DSA_87"] = -50] = "ML_DSA_87";
     COSEALG[COSEALG["RS256"] = -257] = "RS256";
     COSEALG[COSEALG["RS384"] = -258] = "RS384";
     COSEALG[COSEALG["RS512"] = -259] = "RS512";
@@ -88,3 +100,6 @@ export var COSEALG;
 export function isCOSEAlg(alg) {
     return Object.values(COSEALG).indexOf(alg) >= 0;
 }
+export function isPQCCOSEAlg(alg) {
+    return [COSEALG.ML_DSA_44, COSEALG.ML_DSA_65, COSEALG.ML_DSA_87].indexOf(alg) >= 0;
+}

package/esm/helpers/decodeClientDataJSON.d.ts

@@ -8,6 +8,7 @@ export type ClientDataJSON = {
     challenge: string;
     origin: string;
     crossOrigin?: boolean;
+    topOrigin?: string;
     tokenBinding?: {
         id?: string;
         status: 'present' | 'supported' | 'not-supported';

package/esm/helpers/decodeClientDataJSON.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}
+{"version":3,"file":"decodeClientDataJSON.d.ts","sourceRoot":"","sources":["../../src/helpers/decodeClientDataJSON.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAK1E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;sBACvB,cAAc;CACjC,CAAC"}

package/esm/helpers/index.d.ts

@@ -15,4 +15,6 @@ export * from './verifySignature.js';
 export * from './iso/index.js';
 export * from '../metadata/verifyMDSBlob.js';
 export * as cose from './cose.js';
+export { COSEALG } from './cose.js';
+export { type SimpleWebAuthnLogger } from './logging.js';
 //# sourceMappingURL=index.d.ts.map

package/esm/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/esm/helpers/index.js

@@ -15,3 +15,5 @@ export * from './verifySignature.js';
 export * from './iso/index.js';
 export * from '../metadata/verifyMDSBlob.js';
 export * as cose from './cose.js';
+// Specially exporting this for easier `supportedAlgorithmIDs` argument definition
+export { COSEALG } from './cose.js';

package/esm/helpers/isCertRevoked.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { type X509Certificate } from '@peculiar/x509';
 /**
  * A method to pull a CRL from a certificate and compare its serial number to the list of revoked

package/esm/helpers/isCertRevoked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}
+{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}

package/esm/helpers/isCertRevoked.js

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { AuthorityKeyIdentifierExtension, CRLDistributionPointsExtension, SubjectKeyIdentifierExtension, X509Crl, } from '@peculiar/x509';
 import { fetch } from './fetch.js';
 const cacheRevokedCerts = {};

package/esm/helpers/iso/isoCrypto/digest.js

@@ -1,4 +1,4 @@
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
 import { getWebCrypto } from './getWebCrypto.js';
 /**
  * Generate a digest of the provided data.
@@ -8,7 +8,7 @@ import { getWebCrypto } from './getWebCrypto.js';
  */
 export async function digest(data, algorithm) {
     const WebCrypto = await getWebCrypto();
-    const subtleAlgorithm = mapCoseAlgToWebCryptoAlg(algorithm);
+    const subtleAlgorithm = mapCoseAlgToWebCryptoHashAlgName(algorithm);
     const hashed = await WebCrypto.subtle.digest(subtleAlgorithm, data);
     return new Uint8Array(hashed);
 }

package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
+{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CA4C9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}

package/esm/helpers/iso/isoCrypto/getWebCrypto.js

@@ -24,6 +24,18 @@ export function getWebCrypto() {
          */
         const _globalThisCrypto = _getWebCryptoInternals.stubThisGlobalThisCrypto();
         if (_globalThisCrypto) {
+            /**
+             * In Deno v2.7.x, TypeScript 5.9 defines `Crypto.getRandomValues()` as the following type:
+             *
+             * `getRandomValues<T extends ArrayBufferView>(array: T): T;`
+             *
+             * However in earlier versions of TypeScript, `Crypto.getRandomValues()` is defined as such:
+             *
+             * `getRandomValues<T extends ArrayBufferView | null>(array: T): T;`
+             *
+             * Casting to `as unknown as Crypto` here (using this project's `Crypto` types extracted from
+             * DOM types in an older, minimum-supported-Deno version of TypeScript) helps bridge the gap.
+             */
             webCrypto = _globalThisCrypto;
             return resolve(webCrypto);
         }

package/esm/helpers/iso/isoCrypto/importJWKKey.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+export declare function importJWKKey(opts: {
+    keyData: JsonWebKey;
+    algorithm: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams;
+}): Promise<CryptoKey>;
+//# sourceMappingURL=importJWKKey.d.ts.map

package/esm/helpers/iso/isoCrypto/importJWKKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importJWKKey.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/importJWKKey.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,iBAAiB,CAAC;CAC5E,GAAG,OAAO,CAAC,SAAS,CAAC,CAMrB"}

package/esm/helpers/iso/isoCrypto/{importKey.js → importJWKKey.js}

@@ -1,8 +1,10 @@
 import { getWebCrypto } from './getWebCrypto.js';
-export async function importKey(opts) {
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+export async function importJWKKey(opts) {
     const WebCrypto = await getWebCrypto();
     const { keyData, algorithm } = opts;
-    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, [
-        'verify',
-    ]);
+    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, ['verify']);
 }

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts

@@ -0,0 +1,10 @@
+import type { SubtleCryptoAlg } from './structs.js';
+import { COSEALG } from '../../cose.js';
+/**
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
+ */
+export declare function mapCoseAlgToWebCryptoHashAlgName(alg: COSEALG): SubtleCryptoAlg;
+//# sourceMappingURL=mapCoseAlgToWebCryptoHashAlgName.d.ts.map

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCoseAlgToWebCryptoHashAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAe9E"}

package/esm/helpers/iso/isoCrypto/{mapCoseAlgToWebCryptoAlg.js → mapCoseAlgToWebCryptoHashAlgName.js}

@@ -1,8 +1,11 @@
 import { COSEALG } from '../../cose.js';
 /**
- * Convert a COSE alg ID into a corresponding string value that WebCrypto APIs expect
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
-export function mapCoseAlgToWebCryptoAlg(alg) {
+export function mapCoseAlgToWebCryptoHashAlgName(alg) {
     if ([COSEALG.RS1].indexOf(alg) >= 0) {
         return 'SHA-1';
     }
@@ -16,5 +19,5 @@ export function mapCoseAlgToWebCryptoAlg(alg) {
         0) {
         return 'SHA-512';
     }
-    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`);
+    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto hash alg name`);
 }

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts

@@ -1,7 +1,10 @@
 import { COSEALG } from '../../cose.js';
-import { SubtleCryptoKeyAlgName } from './structs.js';
+import type { SubtleCryptoKeyAlgName } from './structs.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export declare function mapCoseAlgToWebCryptoKeyAlgName(alg: COSEALG): SubtleCryptoKeyAlgName;
 //# sourceMappingURL=mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAoBxB"}
+{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAuBxB"}

package/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js

@@ -1,6 +1,9 @@
 import { COSEALG } from '../../cose.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     if ([COSEALG.EdDSA].indexOf(alg) >= 0) {
@@ -15,5 +18,17 @@ export function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     else if ([COSEALG.PS256, COSEALG.PS384, COSEALG.PS512].indexOf(alg) >= 0) {
         return 'RSA-PSS';
     }
+    else if ([COSEALG.ML_DSA_44].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-44';
+    }
+    else if ([COSEALG.ML_DSA_65].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-65';
+    }
+    else if ([COSEALG.ML_DSA_87].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-87';
+    }
     throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`);
 }