@simplewebauthn/server 13.3.3 → 14.0.1

package/script/registration/generateRegistrationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
+{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAchG;;;;;GAKG;AACH,eAAO,IAAI,4BAA4B,EAAE,OAAO,EAI/C,CAAC;AAMF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}

package/script/registration/generateRegistrationOptions.js

@@ -1,37 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.supportedCOSEAlgorithmIdentifiers = void 0;
+exports.defaultSupportedAlgorithmIDs = void 0;
 exports.generateRegistrationOptions = generateRegistrationOptions;
+const settingsService_js_1 = require("../services/settingsService.js");
 const generateChallenge_js_1 = require("../helpers/generateChallenge.js");
 const generateUserID_js_1 = require("../helpers/generateUserID.js");
 const index_js_1 = require("../helpers/iso/index.js");
-/**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
- */
-exports.supportedCOSEAlgorithmIdentifiers = [
-    // EdDSA (In first position to encourage authenticators to use this over ES256)
-    -8,
-    // ECDSA w/ SHA-256
-    -7,
-    // ECDSA w/ SHA-512
-    -36,
-    // RSASSA-PSS w/ SHA-256
-    -37,
-    // RSASSA-PSS w/ SHA-384
-    -38,
-    // RSASSA-PSS w/ SHA-512
-    -39,
-    // RSASSA-PKCS1-v1_5 w/ SHA-256
-    -257,
-    // RSASSA-PKCS1-v1_5 w/ SHA-384
-    -258,
-    // RSASSA-PKCS1-v1_5 w/ SHA-512
-    -259,
-    // RSASSA-PKCS1-v1_5 w/ SHA-1 (Deprecated; here for legacy support)
-    -65535,
-];
+const cose_js_1 = require("../helpers/cose.js");
 /**
  * Set up some default authenticator selection options as per the latest spec:
  * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria
@@ -49,7 +24,14 @@ const defaultAuthenticatorSelection = {
  *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
  *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-const defaultSupportedAlgorithmIDs = [-8, -7, -257];
+exports.defaultSupportedAlgorithmIDs = [
+    cose_js_1.COSEALG.EdDSA,
+    cose_js_1.COSEALG.ES256,
+    cose_js_1.COSEALG.RS256,
+];
+if (settingsService_js_1.SettingsService.runtimeSupportsPQC()) {
+    exports.defaultSupportedAlgorithmIDs = [cose_js_1.COSEALG.ML_DSA_44, ...exports.defaultSupportedAlgorithmIDs];
+}
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -66,11 +48,11 @@ const defaultSupportedAlgorithmIDs = [-8, -7, -257];
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 async function generateRegistrationOptions(options) {
-    const { rpName, rpID, userName, userID, challenge = await (0, generateChallenge_js_1.generateChallenge)(), userDisplayName = '', timeout = 60000, attestationType = 'none', excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs, preferredAuthenticatorType, } = options;
+    const { rpName, rpID, userName, userID, challenge = await (0, generateChallenge_js_1.generateChallenge)(), userDisplayName = '', timeout = 60000, attestationType = 'none', excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = exports.defaultSupportedAlgorithmIDs, preferredAuthenticatorType, } = options;
     /**
      * Prepare pubKeyCredParams from the array of algorithm ID's
      */

package/script/registration/verifications/tpm/constants.d.ts

@@ -25,7 +25,7 @@ export declare const TPM_ALG: {
 export declare const TPM_ECC_CURVE: {
     [key: number]: string;
 };
-type ManufacturerInfo = {
+export type ManufacturerInfo = {
     name: string;
     id: string;
 };
@@ -44,5 +44,4 @@ export declare const TPM_MANUFACTURERS: {
 export declare const TPM_ECC_CURVE_COSE_CRV_MAP: {
     [key: string]: number;
 };
-export {};
 //# sourceMappingURL=constants.d.ts.map

package/script/registration/verifications/tpm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAgChE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAkB3C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAsC5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAUlD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CA+BhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAM/D,CAAC"}

package/script/registration/verifications/tpm/constants.js

@@ -107,8 +107,7 @@ exports.TPM_MANUFACTURERS = {
     'id:48504900': { name: 'HPI', id: 'HPI' },
     'id:48504500': { name: 'HPE', id: 'HPE' },
     'id:48495349': { name: 'Huawei', id: 'HISI' },
-    'id:49424d00': { name: 'IBM', id: 'IBM' },
-    'id:49424D00': { name: 'IBM', id: 'IBM' }, // Same ID for IBM as above, except the "D" is capitalized as per TPM spec
+    'id:49424D00': { name: 'IBM', id: 'IBM' }, // IBM is "id:49424d00" in the TPM spec. It's been normalized here
     'id:49465800': { name: 'Infineon', id: 'IFX' },
     'id:494E5443': { name: 'Intel', id: 'INTC' },
     'id:4C454E00': { name: 'Lenovo', id: 'LEN' },

package/script/registration/verifications/tpm/isValidTPMManufacturerID.d.ts

@@ -0,0 +1,3 @@
+import { type ManufacturerInfo } from './constants.js';
+export declare function getTPMManufacturerInfo(id: string): ManufacturerInfo | undefined;
+//# sourceMappingURL=isValidTPMManufacturerID.d.ts.map

package/script/registration/verifications/tpm/isValidTPMManufacturerID.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isValidTPMManufacturerID.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/isValidTPMManufacturerID.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,gBAAgB,CAAC;AAE1E,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAK/E"}

package/script/registration/verifications/tpm/isValidTPMManufacturerID.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTPMManufacturerInfo = getTPMManufacturerInfo;
+const constants_js_1 = require("./constants.js");
+function getTPMManufacturerInfo(id) {
+    // e.g. "id:51434f4d" -> "id:51434f4D"
+    const _normalized = `id:${id.substring(3).toUpperCase()}`;
+    return constants_js_1.TPM_MANUFACTURERS[_normalized];
+}

package/script/registration/verifications/tpm/verifyAttestationTPM.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAwBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}
+{"version":3,"file":"verifyAttestationTPM.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyAttestationTPM.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAyBzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA+VlB"}

package/script/registration/verifications/tpm/verifyAttestationTPM.js

@@ -17,6 +17,7 @@ const verifyAttestationWithMetadata_js_1 = require("../../../metadata/verifyAtte
 const constants_js_1 = require("./constants.js");
 const parseCertInfo_js_1 = require("./parseCertInfo.js");
 const parsePubArea_js_1 = require("./parsePubArea.js");
+const isValidTPMManufacturerID_js_1 = require("./isValidTPMManufacturerID.js");
 async function verifyAttestationTPM(options) {
     const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash, rootCertificates, } = options;
     const ver = attStmt.get('ver');
@@ -203,7 +204,7 @@ async function verifyAttestationTPM(options) {
         throw new Error('Certificate did not contain ExtendedKeyUsage extension (TPM)');
     }
     // Check that tcpaTpmManufacturer (2.23.133.2.1) field is set to a valid manufacturer ID.
-    if (!constants_js_1.TPM_MANUFACTURERS[tcgAtTpmManufacturer]) {
+    if (!(0, isValidTPMManufacturerID_js_1.getTPMManufacturerInfo)(tcgAtTpmManufacturer)) {
         throw new Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);
     }
     // Check that certificate contains extKeyUsage (2.5.29.37) extension and it must contain

package/script/registration/verifications/verifyAttestationPacked.js

@@ -94,7 +94,7 @@ async function verifyAttestationPacked(options) {
             }
             catch (err) {
                 const _err = err;
-                throw new Error(`${_err.message} (Packed|Full)`);
+                throw new Error(`${_err.message} (Packed|Full)`, { cause: _err });
             }
         }
         verified = await (0, verifySignature_js_1.verifySignature)({

package/script/registration/verifyRegistrationResponse.d.ts

@@ -1,4 +1,4 @@
-import type { COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
+import type { CredentialDeviceType, RegistrationResponseJSON, Uint8Array_, WebAuthnCredential } from '../types/index.js';
 import { type AttestationFormat, type AttestationStatement } from '../helpers/decodeAttestationObject.js';
 import type { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 /**
@@ -17,7 +17,7 @@ export type VerifyRegistrationResponseOpts = Parameters<typeof verifyRegistratio
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 export declare function verifyRegistrationResponse(options: {
@@ -28,7 +28,7 @@ export declare function verifyRegistrationResponse(options: {
     expectedType?: string | string[];
     requireUserPresence?: boolean;
     requireUserVerification?: boolean;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     attestationSafetyNetEnforceCTSCheck?: boolean;
 }): Promise<VerifiedRegistrationResponse>;
 /**

package/script/registration/verifyRegistrationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CA8PvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}

package/script/registration/verifyRegistrationResponse.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyRegistrationResponse = verifyRegistrationResponse;
+const index_js_1 = require("../errors/index.js");
 const decodeAttestationObject_js_1 = require("../helpers/decodeAttestationObject.js");
 const decodeClientDataJSON_js_1 = require("../helpers/decodeClientDataJSON.js");
 const parseAuthenticatorData_js_1 = require("../helpers/parseAuthenticatorData.js");
@@ -10,7 +11,7 @@ const cose_js_1 = require("../helpers/cose.js");
 const convertAAGUIDToString_js_1 = require("../helpers/convertAAGUIDToString.js");
 const parseBackupFlags_js_1 = require("../helpers/parseBackupFlags.js");
 const matchExpectedRPID_js_1 = require("../helpers/matchExpectedRPID.js");
-const index_js_1 = require("../helpers/iso/index.js");
+const index_js_2 = require("../helpers/iso/index.js");
 const settingsService_js_1 = require("../services/settingsService.js");
 const generateRegistrationOptions_js_1 = require("./generateRegistrationOptions.js");
 const verifyAttestationFIDOU2F_js_1 = require("./verifications/verifyAttestationFIDOU2F.js");
@@ -31,11 +32,11 @@ const verifyAttestationApple_js_1 = require("./verifications/verifyAttestationAp
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
  * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Should be the same value that was specified for this same argument when calling `generateRegistrationOptions()`. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param attestationSafetyNetEnforceCTSCheck **(Optional)** - Require that an Android device's system integrity has not been tampered with if it uses SafetyNet attestation. Defaults to `true`
  */
 async function verifyRegistrationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = generateRegistrationOptions_js_1.supportedCOSEAlgorithmIdentifiers, attestationSafetyNetEnforceCTSCheck = true, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = generateRegistrationOptions_js_1.defaultSupportedAlgorithmIDs, attestationSafetyNetEnforceCTSCheck = true, } = options;
     const { id, rawId, type: credentialType, response: attestationResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -94,7 +95,7 @@ async function verifyRegistrationResponse(options) {
             throw new Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`);
         }
     }
-    const attestationObject = index_js_1.isoBase64URL.toBuffer(attestationResponse.attestationObject);
+    const attestationObject = index_js_2.isoBase64URL.toBuffer(attestationResponse.attestationObject);
     const decodedAttestationObject = (0, decodeAttestationObject_js_1.decodeAttestationObject)(attestationObject);
     const fmt = decodedAttestationObject.get('fmt');
     const authData = decodedAttestationObject.get('authData');
@@ -131,19 +132,29 @@ async function verifyRegistrationResponse(options) {
         throw new Error('No AAGUID was present during registration');
     }
     const decodedPublicKey = (0, decodeCredentialPublicKey_js_1.decodeCredentialPublicKey)(credentialPublicKey);
-    const alg = decodedPublicKey.get(cose_js_1.COSEKEYS.alg);
-    if (typeof alg !== 'number') {
+    const pubKeyAlg = decodedPublicKey.get(cose_js_1.COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
         throw new Error('Credential public key was missing numeric alg');
     }
     // Make sure the key algorithm is one we specified within the registration options
-    if (!supportedAlgorithmIDs.includes(alg)) {
+    if (!supportedAlgorithmIDs.includes(pubKeyAlg)) {
         const supported = supportedAlgorithmIDs.join(', ');
-        throw new Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`);
+        throw new Error(`Unexpected public key alg "${pubKeyAlg}", expected one of "${supported}"`);
     }
-    const clientDataHash = await (0, toHash_js_1.toHash)(index_js_1.isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
-    const rootCertificates = settingsService_js_1.SettingsService.getRootCertificates({
-        identifier: fmt,
-    });
+    /**
+     * If the runtime doesn't support PQC passkeys then terminate here at the first sign of a PQC
+     * algorithm so that downstream issues that arise due to lack of PQC support won't get masked as
+     * unexpected behavior.
+     *
+     * I'm choosing to raise here even if attestation is "none" because it feels weird to allow an RP
+     * to parse a registration response w/o attestation only to encounter failure when trying to auth
+     * with the PQC passkey and the runtime doesn't support PQC.
+     */
+    if ((0, cose_js_1.isPQCCOSEAlg)(pubKeyAlg) && !settingsService_js_1.SettingsService.runtimeSupportsPQC()) {
+        throw new index_js_1.PQCNotSupportedError(pubKeyAlg);
+    }
+    const clientDataHash = await (0, toHash_js_1.toHash)(index_js_2.isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
+    const rootCertificates = settingsService_js_1.SettingsService.getRootCertificates({ identifier: fmt });
     // Prepare arguments to pass to the relevant verification method
     const verifierOpts = {
         aaguid,
@@ -199,7 +210,7 @@ async function verifyRegistrationResponse(options) {
             aaguid: (0, convertAAGUIDToString_js_1.convertAAGUIDToString)(aaguid),
             credentialType,
             credential: {
-                id: index_js_1.isoBase64URL.fromBuffer(credentialID),
+                id: index_js_2.isoBase64URL.fromBuffer(credentialID),
                 publicKey: credentialPublicKey,
                 counter,
                 transports: response.response.transports,

package/script/services/metadataService.d.ts

@@ -1,4 +1,5 @@
 import type { MetadataStatement } from '../metadata/mdsTypes.js';
+import { type SimpleWebAuthnLogger } from '../helpers/logging.js';
 import type { Uint8Array_ } from '../types/index.js';
 /**
  * Allow MetadataService to accommodate unregistered AAGUIDs (`"permissive"`), or only allow
@@ -24,6 +25,7 @@ interface MetadataService {
         mdsServers?: string[];
         statements?: MetadataStatement[];
         verificationMode?: VerificationMode;
+        logger?: SimpleWebAuthnLogger;
     }): Promise<void>;
     /**
      * Get a metadata statement for a given AAGUID.
@@ -44,10 +46,12 @@ export declare class BaseMetadataService implements MetadataService {
     private statementCache;
     private state;
     private verificationMode;
+    private logger;
     initialize(opts?: {
         mdsServers?: string[];
         statements?: MetadataStatement[];
         verificationMode?: VerificationMode;
+        logger?: SimpleWebAuthnLogger;
     }): Promise<void>;
     getStatement(aaguid: string | Uint8Array_): Promise<MetadataStatement | undefined>;
     /**

package/script/services/metadataService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadataService.d.ts","sourceRoot":"","sources":["../../src/services/metadataService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4B,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmCrD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAIvD,UAAU,eAAe;IACvB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,IAAI,CAAC,EAAE;QAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,KAAK,CAAyC;IACtD,OAAO,CAAC,gBAAgB,CAA8B;IAEhD,UAAU,CACd,IAAI,GAAE;QACJ,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KAChC,GACL,OAAO,CAAC,IAAI,CAAC;IA4EV,YAAY,CAChB,MAAM,EAAE,MAAM,GAAG,WAAW,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IA8DzC;;OAEG;YACW,YAAY;IAU1B;;OAEG;YACW,UAAU;IA8CxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;OAEG;IACH,OAAO,CAAC,QAAQ;CAWjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}
+{"version":3,"file":"metadataService.d.ts","sourceRoot":"","sources":["../../src/services/metadataService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4B,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmCrD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEvD,UAAU,eAAe;IACvB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,IAAI,CAAC,EAAE;QAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,KAAK,CAAyC;IACtD,OAAO,CAAC,gBAAgB,CAA8B;IACtD,OAAO,CAAC,MAAM,CAAqD;IAE7D,UAAU,CACd,IAAI,GAAE;QACJ,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC1B,GACL,OAAO,CAAC,IAAI,CAAC;IAmFV,YAAY,CAChB,MAAM,EAAE,MAAM,GAAG,WAAW,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IA8DzC;;OAEG;YACW,YAAY;IAU1B;;OAEG;YACW,UAAU;IA8CxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;OAEG;IACH,OAAO,CAAC,QAAQ;CAWjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}

package/script/services/metadataService.js

@@ -20,7 +20,6 @@ var SERVICE_STATE;
     SERVICE_STATE[SERVICE_STATE["REFRESHING"] = 1] = "REFRESHING";
     SERVICE_STATE[SERVICE_STATE["READY"] = 2] = "READY";
 })(SERVICE_STATE || (SERVICE_STATE = {}));
-const log = (0, logging_js_1.getLogger)('MetadataService');
 /**
  * An implementation of `MetadataService` that can download and parse BLOBs, and support on-demand
  * requesting and caching of individual metadata statements.
@@ -53,11 +52,18 @@ class BaseMetadataService {
             writable: true,
             value: 'strict'
         });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: logging_js_1.DefaultNoopLogger
+        });
     }
     async initialize(opts = {}) {
         // Reset statement cache
         this.statementCache = {};
-        const { mdsServers = [defaultURLMDS], statements, verificationMode } = opts;
+        const { mdsServers = [defaultURLMDS], statements, verificationMode, logger = logging_js_1.DefaultNoopLogger, } = opts;
+        this.logger = (0, logging_js_1.buildLoggerAllMethods)(logger);
         this.setState(SERVICE_STATE.REFRESHING);
         /**
          * If metadata statements are provided, load them into the cache first. These statements will
@@ -79,7 +85,7 @@ class BaseMetadataService {
                     statementsAdded += 1;
                 }
             });
-            log(`Cached ${statementsAdded} local statements`);
+            this.logger.info(`Cached ${statementsAdded} local statements`);
         }
         /**
          * If MDS servers are provided, then download blobs from them, verify them, and then add their
@@ -102,14 +108,14 @@ class BaseMetadataService {
                 }
                 catch (err) {
                     // Notify of the error and move on
-                    log(`Could not download BLOB from ${url}:`, err);
+                    this.logger.error(`Could not download BLOB from ${url}:`, err);
                     numServers -= 1;
                 }
             }
             // Calculate the difference to get the total number of new statements we successfully added
             const newCacheCount = Object.keys(this.statementCache).length;
             const cacheDiff = newCacheCount - currentCacheCount;
-            log(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
+            this.logger.info(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
         }
         if (verificationMode) {
             this.verificationMode = verificationMode;
@@ -213,7 +219,7 @@ class BaseMetadataService {
                 // TODO (Feb 2026): It'd be more actionable for devs if a specific error was raised here,
                 // then this message was logged higher up when it can include the array index of the stale
                 // blob.
-                log(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
+                this.logger.warn(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
             }
         }
     }
@@ -252,13 +258,13 @@ class BaseMetadataService {
     setState(newState) {
         this.state = newState;
         if (newState === SERVICE_STATE.DISABLED) {
-            log('MetadataService is DISABLED');
+            this.logger.debug('MetadataService is DISABLED');
         }
         else if (newState === SERVICE_STATE.REFRESHING) {
-            log('MetadataService is REFRESHING');
+            this.logger.debug('MetadataService is REFRESHING');
         }
         else if (newState === SERVICE_STATE.READY) {
-            log('MetadataService is READY');
+            this.logger.debug('MetadataService is READY');
         }
     }
 }

package/script/services/settingsService.d.ts

@@ -19,6 +19,10 @@ interface SettingsService {
     getRootCertificates(opts: {
         identifier: RootCertIdentifier;
     }): string[];
+    /**
+     * Get the runtime's ability to support PQC algorithms by detecting support for ML-DSA-44
+     */
+    runtimeSupportsPQC(): boolean;
 }
 /**
  * A basic service for specifying acceptable root certificates for all supported attestation

package/script/services/settingsService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settingsService.d.ts","sourceRoot":"","sources":["../../src/services/settingsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYrD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE3D,UAAU,eAAe;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,IAAI,EAAE;QACxB,UAAU,EAAE,kBAAkB,CAAC;QAC/B,YAAY,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;KACxC,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM,EAAE,CAAC;CACzE;AAkCD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}
+{"version":3,"file":"settingsService.d.ts","sourceRoot":"","sources":["../../src/services/settingsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAarD,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE3D,UAAU,eAAe;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,IAAI,EAAE;QACxB,UAAU,EAAE,kBAAkB,CAAC;QAC/B,YAAY,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;KACxC,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM,EAAE,CAAC;IAExE;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAAC;CAC/B;AAyCD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAA2C,CAAC"}

package/script/services/settingsService.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SettingsService = void 0;
 const convertCertBufferToPEM_js_1 = require("../helpers/convertCertBufferToPEM.js");
+const runtimeSupportsWebCryptoKeyAlg_js_1 = require("../helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js");
 const android_safetynet_js_1 = require("./defaultRootCerts/android-safetynet.js");
 const android_key_js_1 = require("./defaultRootCerts/android-key.js");
 const apple_js_1 = require("./defaultRootCerts/apple.js");
@@ -15,7 +16,15 @@ class BaseSettingsService {
             writable: true,
             value: void 0
         });
+        // Track whether the runtime supports PQC algorithms
+        Object.defineProperty(this, "_runtimeSupportsPQC", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
         this.pemCertificates = new Map();
+        this._runtimeSupportsPQC = (0, runtimeSupportsWebCryptoKeyAlg_js_1.runtimeSupportsWebCryptoKeyAlg)('ML-DSA-44');
     }
     setRootCertificates(opts) {
         const { identifier, certificates } = opts;
@@ -34,6 +43,9 @@ class BaseSettingsService {
         const { identifier } = opts;
         return this.pemCertificates.get(identifier) ?? [];
     }
+    runtimeSupportsPQC() {
+        return this._runtimeSupportsPQC;
+    }
 }
 /**
  * A basic service for specifying acceptable root certificates for all supported attestation