@simplewebauthn/server 13.3.3 → 14.0.1

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts

@@ -0,0 +1,7 @@
+import type { AlgorithmIdentifier } from '../../../types/index.js';
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export declare function runtimeSupportsWebCryptoKeyAlg(alg: AlgorithmIdentifier): boolean;
+//# sourceMappingURL=runtimeSupportsWebCryptoKeyAlg.d.ts.map

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSupportsWebCryptoKeyAlg.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;AAEvF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAYhF"}

package/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js

@@ -0,0 +1,16 @@
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export function runtimeSupportsWebCryptoKeyAlg(alg) {
+    const globalSubtleCrypto = globalThis.SubtleCrypto;
+    if (typeof globalSubtleCrypto.supports !== 'function') {
+        return false;
+    }
+    try {
+        return globalSubtleCrypto.supports('verify', alg);
+    }
+    catch (_err) {
+        return false;
+    }
+}

package/esm/helpers/iso/isoCrypto/structs.d.ts

@@ -1,4 +1,4 @@
 export type SubtleCryptoAlg = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 export type SubtleCryptoCrv = 'P-256' | 'P-384' | 'P-521' | 'Ed25519';
-export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
+export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
 //# sourceMappingURL=structs.d.ts.map

package/esm/helpers/iso/isoCrypto/structs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,SAAS,CAAC"}
+{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,WAAW,GACX,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,SAAS,CAAC"}

package/esm/helpers/iso/isoCrypto/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAMnB,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BnB"}

package/esm/helpers/iso/isoCrypto/verify.js

@@ -1,4 +1,5 @@
-import { COSEKEYS, isCOSECrv, isCOSEPublicKeyEC2, isCOSEPublicKeyOKP, isCOSEPublicKeyRSA, } from '../../cose.js';
+import { COSEKEYS, isCOSECrv, isCOSEPublicKeyAKP, isCOSEPublicKeyEC2, isCOSEPublicKeyOKP, isCOSEPublicKeyRSA, } from '../../cose.js';
+import { verifyAKP } from './verifyAKP.js';
 import { verifyEC2 } from './verifyEC2.js';
 import { verifyRSA } from './verifyRSA.js';
 import { verifyOKP } from './verifyOKP.js';
@@ -27,6 +28,9 @@ export function verify(opts) {
     else if (isCOSEPublicKeyOKP(cosePublicKey)) {
         return verifyOKP({ cosePublicKey, signature, data });
     }
+    else if (isCOSEPublicKeyAKP(cosePublicKey)) {
+        return verifyAKP({ cosePublicKey, signature, data });
+    }
     const kty = cosePublicKey.get(COSEKEYS.kty);
     throw new Error(`Signature verification with public key of kty ${kty} is not supported by this method`);
 }

package/esm/helpers/iso/isoCrypto/verifyAKP.d.ts

@@ -0,0 +1,9 @@
+import { type COSEPublicKeyAKP } from '../../cose.js';
+import type { Uint8Array_ } from '../../../types/index.js';
+/** AKP, a.k.a ML-DSA */
+export declare function verifyAKP(opts: {
+    cosePublicKey: COSEPublicKeyAKP;
+    signature: Uint8Array_;
+    data: Uint8Array_;
+}): Promise<boolean>;
+//# sourceMappingURL=verifyAKP.d.ts.map

package/esm/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAM3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CA+CnB"}

package/esm/helpers/iso/isoCrypto/verifyAKP.js

@@ -0,0 +1,48 @@
+import { COSEKEYS, isCOSEAlg } from '../../cose.js';
+import { isoBase64URL } from '../../index.js';
+import { importJWKKey } from './importJWKKey.js';
+import { getWebCrypto } from './getWebCrypto.js';
+import { mapCoseAlgToWebCryptoKeyAlgName } from './mapCoseAlgToWebCryptoKeyAlgName.js';
+import { PQCNotSupportedError } from '../../../errors/index.js';
+/** AKP, a.k.a ML-DSA */
+export async function verifyAKP(opts) {
+    const { cosePublicKey, signature, data } = opts;
+    const WebCrypto = await getWebCrypto();
+    const alg = cosePublicKey.get(COSEKEYS.alg);
+    const pub = cosePublicKey.get(COSEKEYS.pub);
+    if (!alg) {
+        throw new Error('Public key was missing alg (AKP)');
+    }
+    if (!isCOSEAlg(alg)) {
+        throw new Error(`Public key had invalid alg ${alg} (AKP)`);
+    }
+    if (!pub) {
+        throw new Error('Public key was missing pub (AKP)');
+    }
+    const webCryptoAlg = mapCoseAlgToWebCryptoKeyAlgName(alg);
+    // See https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-operations-import-key -> "jwk"
+    const keyData = {
+        kty: 'AKP',
+        alg: webCryptoAlg,
+        pub: isoBase64URL.fromBuffer(pub),
+        ext: false,
+    };
+    /**
+     * ML-DSA support is pretty cutting edge, so take some steps to help RP's understand this instead
+     * of them getting a `NotSupportedError: Unrecognized algorithm name` and trying to interpret it.
+     */
+    let key;
+    try {
+        key = await importJWKKey({ keyData, algorithm: webCryptoAlg });
+    }
+    catch (err) {
+        const _err = err;
+        if (_err.name === 'NotSupportedError') {
+            throw new PQCNotSupportedError(alg);
+        }
+        else {
+            throw err;
+        }
+    }
+    return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
+}

package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
+{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAuEnB"}

package/esm/helpers/iso/isoCrypto/verifyEC2.js

@@ -1,6 +1,6 @@
 import { COSECRV, COSEKEYS } from '../../cose.js';
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
-import { importKey } from './importKey.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
+import { importJWKKey } from './importJWKKey.js';
 import { isoBase64URL } from '../index.js';
 import { getWebCrypto } from './getWebCrypto.js';
 /**
@@ -56,14 +56,11 @@ export async function verifyEC2(opts) {
         name: 'ECDSA',
         namedCurve: _crv,
     };
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     // Determine which SHA algorithm to use for signature verification
-    let subtleAlg = mapCoseAlgToWebCryptoAlg(alg);
+    let subtleAlg = mapCoseAlgToWebCryptoHashAlgName(alg);
     if (shaHashOverride) {
-        subtleAlg = mapCoseAlgToWebCryptoAlg(shaHashOverride);
+        subtleAlg = mapCoseAlgToWebCryptoHashAlgName(shaHashOverride);
     }
     const verifyAlgorithm = {
         name: 'ECDSA',

package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
+{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsDnB"}

package/esm/helpers/iso/isoCrypto/verifyOKP.js

@@ -1,6 +1,6 @@
 import { COSECRV, COSEKEYS, isCOSEAlg } from '../../cose.js';
 import { isoBase64URL } from '../../index.js';
-import { importKey } from './importKey.js';
+import { importJWKKey } from './importJWKKey.js';
 import { getWebCrypto } from './getWebCrypto.js';
 export async function verifyOKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -40,10 +40,7 @@ export async function verifyOKP(opts) {
         name: _crv,
         namedCurve: _crv,
     };
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     const verifyAlgorithm = {
         name: _crv,
     };

package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
+{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAwFnB"}

package/esm/helpers/iso/isoCrypto/verifyRSA.js

@@ -1,6 +1,6 @@
 import { COSEKEYS, isCOSEAlg } from '../../cose.js';
-import { mapCoseAlgToWebCryptoAlg } from './mapCoseAlgToWebCryptoAlg.js';
-import { importKey } from './importKey.js';
+import { mapCoseAlgToWebCryptoHashAlgName } from './mapCoseAlgToWebCryptoHashAlgName.js';
+import { importJWKKey } from './importJWKKey.js';
 import { isoBase64URL } from '../index.js';
 import { mapCoseAlgToWebCryptoKeyAlgName } from './mapCoseAlgToWebCryptoKeyAlgName.js';
 import { getWebCrypto } from './getWebCrypto.js';
@@ -34,13 +34,13 @@ export async function verifyRSA(opts) {
     };
     const keyAlgorithm = {
         name: mapCoseAlgToWebCryptoKeyAlgName(alg),
-        hash: { name: mapCoseAlgToWebCryptoAlg(alg) },
+        hash: { name: mapCoseAlgToWebCryptoHashAlgName(alg) },
     };
     const verifyAlgorithm = {
         name: mapCoseAlgToWebCryptoKeyAlgName(alg),
     };
     if (shaHashOverride) {
-        keyAlgorithm.hash.name = mapCoseAlgToWebCryptoAlg(shaHashOverride);
+        keyAlgorithm.hash.name = mapCoseAlgToWebCryptoHashAlgName(shaHashOverride);
     }
     if (keyAlgorithm.name === 'RSASSA-PKCS1-v1_5') {
         if (keyAlgorithm.hash.name === 'SHA-256') {
@@ -83,9 +83,6 @@ export async function verifyRSA(opts) {
     else {
         throw new Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);
     }
-    const key = await importKey({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await importJWKKey({ keyData, algorithm: keyAlgorithm });
     return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }

package/esm/helpers/logging.d.ts

@@ -1,16 +1,34 @@
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
+ * A basic logging interface that enables projects to capture logging output from SimpleWebAuthn
+ * using whatever logging method is appropriate for the project. Logging levels can be defined
+ * independently to only capture desired levels.
  *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
+ * For example, a project using `console` statements to capture logs can use the following
+ * implementation of this interface:
  *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
+ * ```ts
+ * const ConsoleLogger: SimpleWebAuthnLogger = {
+ *   // debug(message: string, ...args: unknown[]) { console.debug(message, ...args); },
+ *   info(message: string, ...args: unknown[]) { console.info(message, ...args); },
+ *   warn(message: string, ...args: unknown[]) { console.warn(message, ...args); },
+ *   error(message: string, ...args: unknown[]) { console.error(message, ...args); },
+ * };
  * ```
  */
-export declare function getLogger(_name: string): (message: string, ..._rest: unknown[]) => void;
+export interface SimpleWebAuthnLogger {
+    debug?: (message: string, ...args: unknown[]) => void;
+    info?: (message: string, ...args: unknown[]) => void;
+    warn?: (message: string, ...args: unknown[]) => void;
+    error?: (message: string, ...args: unknown[]) => void;
+}
+/**
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
+ */
+export declare const DefaultNoopLogger: Required<SimpleWebAuthnLogger>;
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export declare function buildLoggerAllMethods(logger: SimpleWebAuthnLogger): Required<SimpleWebAuthnLogger>;
 //# sourceMappingURL=logging.d.ts.map

package/esm/helpers/logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAGvF"}
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACvD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,oBAAoB,CAK5D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,oBAAoB,CAAC,CAoBhC"}

package/esm/helpers/logging.js

@@ -1,19 +1,30 @@
-// const defaultLogger = debug('SimpleWebAuthn');
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
- *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
- *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
- * ```
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
  */
-export function getLogger(_name) {
-    // This is a noop for now while I search for a better debug logger technique
-    return (_message, ..._rest) => { };
+export const DefaultNoopLogger = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export function buildLoggerAllMethods(logger) {
+    const toReturn = { ...DefaultNoopLogger };
+    if (logger.debug) {
+        toReturn.debug = logger.debug;
+    }
+    if (logger.info) {
+        toReturn.info = logger.info;
+    }
+    if (logger.warn) {
+        toReturn.warn = logger.warn;
+    }
+    if (logger.error) {
+        toReturn.error = logger.error;
+    }
+    return toReturn;
 }

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.d.ts

@@ -1,9 +1,6 @@
 import { COSEALG } from './cose.js';
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 export declare function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm: string): COSEALG;
 //# sourceMappingURL=mapX509SignatureAlgToCOSEAlg.d.ts.map

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAwBT"}
+{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CA8BT"}

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.js

@@ -1,33 +1,42 @@
+import { id_ecdsaWithSHA256, id_ecdsaWithSHA384, id_ecdsaWithSHA512 } from '@peculiar/asn1-ecc';
+import { id_sha1WithRSAEncryption, id_sha256WithRSAEncryption, id_sha384WithRSAEncryption, id_sha512WithRSAEncryption, } from '@peculiar/asn1-rsa';
+import { id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87 } from '@peculiar/asn1-x509-post-quantum';
 import { COSEALG } from './cose.js';
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 export function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
     let alg;
-    if (signatureAlgorithm === '1.2.840.10045.4.3.2') {
+    if (signatureAlgorithm === id_ecdsaWithSHA256) {
         alg = COSEALG.ES256;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.3') {
+    else if (signatureAlgorithm === id_ecdsaWithSHA384) {
         alg = COSEALG.ES384;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.4') {
+    else if (signatureAlgorithm === id_ecdsaWithSHA512) {
         alg = COSEALG.ES512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.11') {
+    else if (signatureAlgorithm === id_sha256WithRSAEncryption) {
         alg = COSEALG.RS256;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.12') {
+    else if (signatureAlgorithm === id_sha384WithRSAEncryption) {
         alg = COSEALG.RS384;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.13') {
+    else if (signatureAlgorithm === id_sha512WithRSAEncryption) {
         alg = COSEALG.RS512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.5') {
+    else if (signatureAlgorithm === id_sha1WithRSAEncryption) {
         alg = COSEALG.RS1;
     }
+    else if (signatureAlgorithm === id_ml_dsa_44) {
+        alg = COSEALG.ML_DSA_44;
+    }
+    else if (signatureAlgorithm === id_ml_dsa_65) {
+        alg = COSEALG.ML_DSA_65;
+    }
+    else if (signatureAlgorithm === id_ml_dsa_87) {
+        alg = COSEALG.ML_DSA_87;
+    }
     else {
         throw new Error(`Unable to map X.509 signature algorithm ${signatureAlgorithm} to a COSE algorithm`);
     }

package/esm/helpers/validateCertificatePath.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`

package/esm/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}

package/esm/helpers/validateCertificatePath.js

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { X509Certificate, X509ChainBuilder } from '@peculiar/x509';
 import { isCertRevoked } from './isCertRevoked.js';
 /**
@@ -79,15 +80,33 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
-            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            // Attempt to build a certificate path
             const chain = await chainBuilder.build(x5cLeafCert);
-            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
-            if (chain.length < numUniqueCerts) {
-                // Invalid cert chain, try the next trust anchor
-                continue;
+            /**
+             * The cert chain must chain to the anchor. Usually this is as simple as asserting that the
+             * final cert in the chain is the anchor cert. However there's an odd scenario where an
+             * intermediate certificate can chain to an anchor cert's public key, but not actually to the
+             * anchor cert because e.g. the chain builder stopped at a cross-signed cert for the anchor
+             * and not the anchor cert itself.
+             *
+             * So here we're going to check for that. In the simplest case we'll be fine with the last
+             * cert in the chain being byte-equivalent to the current anchor cert. If not, then move a
+             * cert up the chain and explicitly check that it was signed by the anchor cert. This also
+             * future-proofs this logic from the internals of whatever future X.509 library might be used
+             * to build the cert path.
+             */
+            const lastCert = chain[chain.length - 1];
+            const lastCertEqualsAnchor = lastCert.equal(anchor);
+            let certBeforeLastSignedByAnchor = false;
+            if (!lastCertEqualsAnchor && chain.length > 1) {
+                const certBeforeLast = chain[chain.length - 2];
+                certBeforeLastSignedByAnchor = await certBeforeLast.verify({
+                    publicKey: anchor.publicKey,
+                    signatureOnly: true,
+                });
             }
-            // Check if the chain is to the trust anchor
-            if (chain[chain.length - 1].subject !== anchor.subject) {
+            const chainReachesAnchor = lastCertEqualsAnchor || certBeforeLastSignedByAnchor;
+            if (!chainReachesAnchor) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }

package/esm/index.d.ts

@@ -6,4 +6,5 @@ export * from './services/metadataService.js';
 export * from './services/settingsService.js';
 export * from './metadata/mdsTypes.js';
 export * from './types/index.js';
+export * from './errors/index.js';
 //# sourceMappingURL=index.d.ts.map

package/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/esm/index.js

@@ -6,3 +6,4 @@ export * from './services/metadataService.js';
 export * from './services/settingsService.js';
 export * from './metadata/mdsTypes.js';
 export * from './types/index.js';
+export * from './errors/index.js';

package/esm/registration/generateRegistrationOptions.d.ts

@@ -1,11 +1,13 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, Base64URLString, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import { COSEALG } from '../helpers/cose.js';
 export type GenerateRegistrationOptionsOpts = Parameters<typeof generateRegistrationOptions>[0];
 /**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ * Use the most commonly-supported algorithms
+ * See the following:
+ *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[];
+export declare let defaultSupportedAlgorithmIDs: COSEALG[];
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -22,7 +24,7 @@ export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 export declare function generateRegistrationOptions(options: {
@@ -36,11 +38,11 @@ export declare function generateRegistrationOptions(options: {
     attestationType?: 'direct' | 'enterprise' | 'none';
     excludeCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     authenticatorSelection?: AuthenticatorSelectionCriteria;
     extensions?: AuthenticationExtensionsClientInputs;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     preferredAuthenticatorType?: 'securityKey' | 'localDevice' | 'remoteDevice';
 }): Promise<PublicKeyCredentialCreationOptionsJSON>;
 //# sourceMappingURL=generateRegistrationOptions.d.ts.map

package/esm/registration/generateRegistrationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
+{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAchG;;;;;GAKG;AACH,eAAO,IAAI,4BAA4B,EAAE,OAAO,EAI/C,CAAC;AAMF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}

package/esm/registration/generateRegistrationOptions.js

@@ -1,33 +1,8 @@
+import { SettingsService } from '../services/settingsService.js';
 import { generateChallenge } from '../helpers/generateChallenge.js';
 import { generateUserID } from '../helpers/generateUserID.js';
 import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
-/**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
- */
-export const supportedCOSEAlgorithmIdentifiers = [
-    // EdDSA (In first position to encourage authenticators to use this over ES256)
-    -8,
-    // ECDSA w/ SHA-256
-    -7,
-    // ECDSA w/ SHA-512
-    -36,
-    // RSASSA-PSS w/ SHA-256
-    -37,
-    // RSASSA-PSS w/ SHA-384
-    -38,
-    // RSASSA-PSS w/ SHA-512
-    -39,
-    // RSASSA-PKCS1-v1_5 w/ SHA-256
-    -257,
-    // RSASSA-PKCS1-v1_5 w/ SHA-384
-    -258,
-    // RSASSA-PKCS1-v1_5 w/ SHA-512
-    -259,
-    // RSASSA-PKCS1-v1_5 w/ SHA-1 (Deprecated; here for legacy support)
-    -65535,
-];
+import { COSEALG } from '../helpers/cose.js';
 /**
  * Set up some default authenticator selection options as per the latest spec:
  * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria
@@ -45,7 +20,14 @@ const defaultAuthenticatorSelection = {
  *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
  *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-const defaultSupportedAlgorithmIDs = [-8, -7, -257];
+export let defaultSupportedAlgorithmIDs = [
+    COSEALG.EdDSA,
+    COSEALG.ES256,
+    COSEALG.RS256,
+];
+if (SettingsService.runtimeSupportsPQC()) {
+    defaultSupportedAlgorithmIDs = [COSEALG.ML_DSA_44, ...defaultSupportedAlgorithmIDs];
+}
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -62,7 +44,7 @@ const defaultSupportedAlgorithmIDs = [-8, -7, -257];
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 export async function generateRegistrationOptions(options) {

package/esm/registration/verifications/tpm/constants.d.ts

@@ -25,7 +25,7 @@ export declare const TPM_ALG: {
 export declare const TPM_ECC_CURVE: {
     [key: number]: string;
 };
-type ManufacturerInfo = {
+export type ManufacturerInfo = {
     name: string;
     id: string;
 };
@@ -44,5 +44,4 @@ export declare const TPM_MANUFACTURERS: {
 export declare const TPM_ECC_CURVE_COSE_CRV_MAP: {
     [key: string]: number;
 };
-export {};
 //# sourceMappingURL=constants.d.ts.map

package/esm/registration/verifications/tpm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAgChE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CA+BhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}