@simplewebauthn/server 13.3.3 → 14.0.1

package/esm/registration/verifications/tpm/constants.js

@@ -104,8 +104,7 @@ export const TPM_MANUFACTURERS = {
     'id:48504900': { name: 'HPI', id: 'HPI' },
     'id:48504500': { name: 'HPE', id: 'HPE' },
     'id:48495349': { name: 'Huawei', id: 'HISI' },
-    'id:49424d00': { name: 'IBM', id: 'IBM' },
-    'id:49424D00': { name: 'IBM', id: 'IBM' }, // Same ID for IBM as above, except the "D" is capitalized as per TPM spec
+    'id:49424D00': { name: 'IBM', id: 'IBM' }, // IBM is "id:49424d00" in the TPM spec. It's been normalized here
     'id:49465800': { name: 'Infineon', id: 'IFX' },
     'id:494E5443': { name: 'Intel', id: 'INTC' },
     'id:4C454E00': { name: 'Lenovo', id: 'LEN' },

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.d.ts

@@ -0,0 +1,3 @@
+import { type ManufacturerInfo } from './constants.js';
+export declare function getTPMManufacturerInfo(id: string): ManufacturerInfo | undefined;
+//# sourceMappingURL=isValidTPMManufacturerID.d.ts.map

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isValidTPMManufacturerID.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/isValidTPMManufacturerID.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,gBAAgB,CAAC;AAE1E,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAK/E"}

package/esm/registration/verifications/tpm/isValidTPMManufacturerID.js

@@ -0,0 +1,6 @@
+import { TPM_MANUFACTURERS } from './constants.js';
+export function getTPMManufacturerInfo(id) {
+    // e.g. "id:51434f4d" -> "id:51434f4D"
+    const _normalized = `id:${id.substring(3).toUpperCase()}`;
+    return TPM_MANUFACTURERS[_normalized];
+}

package/esm/registration/verifications/tpm/verifyAttestationTPM.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAwBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}
+{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAyBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}

package/esm/registration/verifications/tpm/verifyAttestationTPM.js

@@ -11,9 +11,10 @@ import { isoUint8Array } from '../../../helpers/iso/index.js';
 import { validateExtFIDOGenCEAAGUID } from '../../../helpers/validateExtFIDOGenCEAAGUID.js';
 import { MetadataService } from '../../../services/metadataService.js';
 import { verifyAttestationWithMetadata } from '../../../metadata/verifyAttestationWithMetadata.js';
-import { TPM_ECC_CURVE_COSE_CRV_MAP, TPM_MANUFACTURERS } from './constants.js';
+import { TPM_ECC_CURVE_COSE_CRV_MAP } from './constants.js';
 import { parseCertInfo } from './parseCertInfo.js';
 import { parsePubArea } from './parsePubArea.js';
+import { getTPMManufacturerInfo } from './isValidTPMManufacturerID.js';
 export async function verifyAttestationTPM(options) {
     const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash, rootCertificates, } = options;
     const ver = attStmt.get('ver');
@@ -200,7 +201,7 @@ export async function verifyAttestationTPM(options) {
         throw new Error('Certificate did not contain ExtendedKeyUsage extension (TPM)');
     }
     // Check that tcpaTpmManufacturer (2.23.133.2.1) field is set to a valid manufacturer ID.
-    if (!TPM_MANUFACTURERS[tcgAtTpmManufacturer]) {
+    if (!getTPMManufacturerInfo(tcgAtTpmManufacturer)) {
         throw new Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);
     }
     // Check that certificate contains extKeyUsage (2.5.29.37) extension and it must contain

package/esm/registration/verifications/verifyAttestationPacked.js

@@ -91,7 +91,7 @@ export async function verifyAttestationPacked(options) {
             }
             catch (err) {
                 const _err = err;
-                throw new Error(`${_err.message} (Packed|Full)`);
+                throw new Error(`${_err.message} (Packed|Full)`, { cause: _err });
             }
         }
         verified = await verifySignature({

package/esm/registration/verifyRegistrationResponse.d.ts

@@ -1,4 +1,4 @@
-import type { COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
+import type { CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
 import { type AttestationFormat, type AttestationStatement } from '../helpers/decodeAttestationObject.js';
 import type { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 /**
@@ -17,7 +17,7 @@ export type VerifyRegistrationResponseOpts = Parameters<typeof verifyRegistratio
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 export declare function verifyRegistrationResponse(options: {
@@ -28,7 +28,7 @@ export declare function verifyRegistrationResponse(options: {
     expectedType?: string | string[];
     requireUserPresence?: boolean;
     requireUserVerification?: boolean;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     attestationSafetyNetEnforceCTSCheck?: boolean;
 }): Promise<VerifiedRegistrationResponse>;
 /**

package/esm/registration/verifyRegistrationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CA8PvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}

package/esm/registration/verifyRegistrationResponse.js

@@ -1,15 +1,16 @@
+import { PQCNotSupportedError } from '../errors/index.js';
 import { decodeAttestationObject, } from '../helpers/decodeAttestationObject.js';
 import { decodeClientDataJSON } from '../helpers/decodeClientDataJSON.js';
 import { parseAuthenticatorData } from '../helpers/parseAuthenticatorData.js';
 import { toHash } from '../helpers/toHash.js';
 import { decodeCredentialPublicKey } from '../helpers/decodeCredentialPublicKey.js';
-import { COSEKEYS } from '../helpers/cose.js';
+import { COSEKEYS, isPQCCOSEAlg } from '../helpers/cose.js';
 import { convertAAGUIDToString } from '../helpers/convertAAGUIDToString.js';
 import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
 import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
 import { isoBase64URL } from '../helpers/iso/index.js';
 import { SettingsService } from '../services/settingsService.js';
-import { supportedCOSEAlgorithmIdentifiers } from './generateRegistrationOptions.js';
+import { defaultSupportedAlgorithmIDs } from './generateRegistrationOptions.js';
 import { verifyAttestationFIDOU2F } from './verifications/verifyAttestationFIDOU2F.js';
 import { verifyAttestationPacked } from './verifications/verifyAttestationPacked.js';
 import { verifyAttestationAndroidSafetyNet } from './verifications/verifyAttestationAndroidSafetyNet.js';
@@ -28,11 +29,11 @@ import { verifyAttestationApple } from './verifications/verifyAttestationApple.j
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 export async function verifyRegistrationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = supportedCOSEAlgorithmIdentifiers, attestationSafetyNetEnforceCTSCheck = true, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs, attestationSafetyNetEnforceCTSCheck = true, } = options;
     const { id, rawId, type: credentialType, response: attestationResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -128,19 +129,29 @@ export async function verifyRegistrationResponse(options) {
         throw new Error('No AAGUID was present during registration');
     }
     const decodedPublicKey = decodeCredentialPublicKey(credentialPublicKey);
-    const alg = decodedPublicKey.get(COSEKEYS.alg);
-    if (typeof alg !== 'number') {
+    const pubKeyAlg = decodedPublicKey.get(COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
         throw new Error('Credential public key was missing numeric alg');
     }
     // Make sure the key algorithm is one we specified within the registration options
-    if (!supportedAlgorithmIDs.includes(alg)) {
+    if (!supportedAlgorithmIDs.includes(pubKeyAlg)) {
         const supported = supportedAlgorithmIDs.join(', ');
-        throw new Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`);
+        throw new Error(`Unexpected public key alg "${pubKeyAlg}", expected one of "${supported}"`);
+    }
+    /**
+     * If the runtime doesn't support PQC passkeys then terminate here at the first sign of a PQC
+     * algorithm so that downstream issues that arise due to lack of PQC support won't get masked as
+     * unexpected behavior.
+     *
+     * I'm choosing to raise here even if attestation is "none" because it feels weird to allow an RP
+     * to parse a registration response w/o attestation only to encounter failure when trying to auth
+     * with the PQC passkey and the runtime doesn't support PQC.
+     */
+    if (isPQCCOSEAlg(pubKeyAlg) && !SettingsService.runtimeSupportsPQC()) {
+        throw new PQCNotSupportedError(pubKeyAlg);
     }
     const clientDataHash = await toHash(isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
-    const rootCertificates = SettingsService.getRootCertificates({
-        identifier: fmt,
-    });
+    const rootCertificates = SettingsService.getRootCertificates({ identifier: fmt });
     // Prepare arguments to pass to the relevant verification method
     const verifierOpts = {
         aaguid,

package/esm/services/metadataService.d.ts

@@ -1,4 +1,5 @@
 import type { MetadataStatement } from '../metadata/mdsTypes.js';
+import { type SimpleWebAuthnLogger } from '../helpers/logging.js';
 import type { Uint8Array_ } from '../types/index.js';
 /**
  * Allow MetadataService to accommodate unregistered AAGUIDs (`"permissive"`), or only allow
@@ -24,6 +25,7 @@ interface MetadataService {
         mdsServers?: string[];
         statements?: MetadataStatement[];
         verificationMode?: VerificationMode;
+        logger?: SimpleWebAuthnLogger;
     }): Promise<void>;
     /**
      * Get a metadata statement for a given AAGUID.
@@ -44,10 +46,12 @@ export declare class BaseMetadataService implements MetadataService {
     private statementCache;
     private state;
     private verificationMode;
+    private logger;
     initialize(opts?: {
         mdsServers?: string[];
         statements?: MetadataStatement[];
         verificationMode?: VerificationMode;
+        logger?: SimpleWebAuthnLogger;
     }): Promise<void>;
     getStatement(aaguid: string | Uint8Array_): Promise<MetadataStatement | undefined>;
     /**

package/esm/services/metadataService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadataService.d.ts","sourceRoot":"","sources":["../../src/services/metadataService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4B,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmCrD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAIvD,UAAU,eAAe;IACvB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,IAAI,CAAC,EAAE;QAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,KAAK,CAAyC;IACtD,OAAO,CAAC,gBAAgB,CAA8B;IAEhD,UAAU,CACd,IAAI,GAAE;QACJ,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KAChC,GACL,OAAO,CAAC,IAAI,CAAC;IA4EV,YAAY,CAChB,MAAM,EAAE,MAAM,GAAG,WAAW,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IA8DzC;;OAEG;YACW,YAAY;IAU1B;;OAEG;YACW,UAAU;IA8CxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;OAEG;IACH,OAAO,CAAC,QAAQ;CAWjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}
+{"version":3,"file":"metadataService.d.ts","sourceRoot":"","sources":["../../src/services/metadataService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4B,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmCrD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEvD,UAAU,eAAe;IACvB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,IAAI,CAAC,EAAE;QAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,KAAK,CAAyC;IACtD,OAAO,CAAC,gBAAgB,CAA8B;IACtD,OAAO,CAAC,MAAM,CAAqD;IAE7D,UAAU,CACd,IAAI,GAAE;QACJ,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC1B,GACL,OAAO,CAAC,IAAI,CAAC;IAmFV,YAAY,CAChB,MAAM,EAAE,MAAM,GAAG,WAAW,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IA8DzC;;OAEG;YACW,YAAY;IAU1B;;OAEG;YACW,UAAU;IA8CxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;OAEG;IACH,OAAO,CAAC,QAAQ;CAWjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}

package/esm/services/metadataService.js

@@ -1,6 +1,6 @@
 import { convertAAGUIDToString } from '../helpers/convertAAGUIDToString.js';
 import { verifyMDSBlob } from '../metadata/verifyMDSBlob.js';
-import { getLogger } from '../helpers/logging.js';
+import { buildLoggerAllMethods, DefaultNoopLogger, } from '../helpers/logging.js';
 import { fetch } from '../helpers/fetch.js';
 /**
  * An instance of `CachedMDS` that will not trigger attempts to refresh the associated entry's blob
@@ -17,7 +17,6 @@ var SERVICE_STATE;
     SERVICE_STATE[SERVICE_STATE["REFRESHING"] = 1] = "REFRESHING";
     SERVICE_STATE[SERVICE_STATE["READY"] = 2] = "READY";
 })(SERVICE_STATE || (SERVICE_STATE = {}));
-const log = getLogger('MetadataService');
 /**
  * An implementation of `MetadataService` that can download and parse BLOBs, and support on-demand
  * requesting and caching of individual metadata statements.
@@ -50,11 +49,18 @@ export class BaseMetadataService {
             writable: true,
             value: 'strict'
         });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: DefaultNoopLogger
+        });
     }
     async initialize(opts = {}) {
         // Reset statement cache
         this.statementCache = {};
-        const { mdsServers = [defaultURLMDS], statements, verificationMode } = opts;
+        const { mdsServers = [defaultURLMDS], statements, verificationMode, logger = DefaultNoopLogger, } = opts;
+        this.logger = buildLoggerAllMethods(logger);
         this.setState(SERVICE_STATE.REFRESHING);
         /**
          * If metadata statements are provided, load them into the cache first. These statements will
@@ -76,7 +82,7 @@ export class BaseMetadataService {
                     statementsAdded += 1;
                 }
             });
-            log(`Cached ${statementsAdded} local statements`);
+            this.logger.info(`Cached ${statementsAdded} local statements`);
         }
         /**
          * If MDS servers are provided, then download blobs from them, verify them, and then add their
@@ -99,14 +105,14 @@ export class BaseMetadataService {
                 }
                 catch (err) {
                     // Notify of the error and move on
-                    log(`Could not download BLOB from ${url}:`, err);
+                    this.logger.error(`Could not download BLOB from ${url}:`, err);
                     numServers -= 1;
                 }
             }
             // Calculate the difference to get the total number of new statements we successfully added
             const newCacheCount = Object.keys(this.statementCache).length;
             const cacheDiff = newCacheCount - currentCacheCount;
-            log(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
+            this.logger.info(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
         }
         if (verificationMode) {
             this.verificationMode = verificationMode;
@@ -210,7 +216,7 @@ export class BaseMetadataService {
                 // TODO (Feb 2026): It'd be more actionable for devs if a specific error was raised here,
                 // then this message was logged higher up when it can include the array index of the stale
                 // blob.
-                log(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
+                this.logger.warn(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
             }
         }
     }
@@ -249,13 +255,13 @@ export class BaseMetadataService {
     setState(newState) {
         this.state = newState;
         if (newState === SERVICE_STATE.DISABLED) {
-            log('MetadataService is DISABLED');
+            this.logger.debug('MetadataService is DISABLED');
         }
         else if (newState === SERVICE_STATE.REFRESHING) {
-            log('MetadataService is REFRESHING');
+            this.logger.debug('MetadataService is REFRESHING');
         }
         else if (newState === SERVICE_STATE.READY) {
-            log('MetadataService is READY');
+            this.logger.debug('MetadataService is READY');
         }
     }
 }

package/esm/services/settingsService.d.ts

@@ -19,6 +19,10 @@ interface SettingsService {
     getRootCertificates(opts: {
         identifier: RootCertIdentifier;
     }): string[];
+    /**
+     * Get the runtime's ability to support PQC algorithms by detecting support for ML-DSA-44
+     */
+    runtimeSupportsPQC(): boolean;
 }
 /**
  * A basic service for specifying acceptable root certificates for all supported attestation

package/esm/services/settingsService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settingsService.d.ts","sourceRoot":"","sources":["../../src/services/settingsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYrD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE3D,UAAU,eAAe;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,IAAI,EAAE;QACxB,UAAU,EAAE,kBAAkB,CAAC;QAC/B,YAAY,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;KACxC,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM,EAAE,CAAC;CACzE;AAkCD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}
+{"version":3,"file":"settingsService.d.ts","sourceRoot":"","sources":["../../src/services/settingsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAarD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE3D,UAAU,eAAe;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,IAAI,EAAE;QACxB,UAAU,EAAE,kBAAkB,CAAC;QAC/B,YAAY,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;KACxC,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM,EAAE,CAAC;IAExE;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAAC;CAC/B;AAyCD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}

package/esm/services/settingsService.js

@@ -1,4 +1,5 @@
 import { convertCertBufferToPEM } from '../helpers/convertCertBufferToPEM.js';
+import { runtimeSupportsWebCryptoKeyAlg } from '../helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js';
 import { GlobalSign_Root_CA } from './defaultRootCerts/android-safetynet.js';
 import { Google_Hardware_Attestation_Root_1, Google_Hardware_Attestation_Root_2, Google_Hardware_Attestation_Root_3, Google_Hardware_Attestation_Root_4, } from './defaultRootCerts/android-key.js';
 import { Apple_WebAuthn_Root_CA } from './defaultRootCerts/apple.js';
@@ -12,7 +13,15 @@ class BaseSettingsService {
             writable: true,
             value: void 0
         });
+        // Track whether the runtime supports PQC algorithms
+        Object.defineProperty(this, "_runtimeSupportsPQC", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
         this.pemCertificates = new Map();
+        this._runtimeSupportsPQC = runtimeSupportsWebCryptoKeyAlg('ML-DSA-44');
     }
     setRootCertificates(opts) {
         const { identifier, certificates } = opts;
@@ -31,6 +40,9 @@ class BaseSettingsService {
         const { identifier } = opts;
         return this.pemCertificates.get(identifier) ?? [];
     }
+    runtimeSupportsPQC() {
+        return this._runtimeSupportsPQC;
+    }
 }
 /**
  * A basic service for specifying acceptable root certificates for all supported attestation