1# On a runtime with ML-DSA (Node 24.7 and later, as in the container), the2# forge offers ML-DSA-44 first, and a post-quantum passkey (a 1312-byte3# public key) is added and signs in like any other. Elsewhere, skipped.4. "$(dirname "$0")/../lib.sh"5node -e 'require("crypto").generateKeyPairSync("ml-dsa-44")' 2>/dev/null || { note "node $(node --version) has no ML-DSA: skipped"; exit 0; }6user dami7repo --private dami/secret8clone dami dami/secret "$T/w/dami"9at "$T/w/dami" commit "first"10ok push_as dami "$T/w/dami" origin main11build12export FORGE_BASE_URL=https://forge.test13private_server14code=$(ssh_as dami passkey quantum | sed -n 's/^ .*#enroll=//p')15http -s -X POST -H 'Origin: https://forge.test' -d "{\"code\":\"$code\"}" "$PRIV/login/enroll/options" >"$T/options"16has "$T/options" '"pubKeyCredParams":\[\{"alg":-48,'17c=$(node "$T_HOME/test/authenticator.ts" enroll "$PRIV" "$code" "$T/dami.key" --alg ml-dsa-44) || fail "enroll"18eq "$(http -s -o /dev/null -w '%{http_code}' -H "Cookie: __Host-forge=$c" "$PRIV/dami/secret/")" 20019c=$(node "$T_HOME/test/authenticator.ts" login "$PRIV" "$T/dami.key") || fail "login"20eq "$(http -s -o /dev/null -w '%{http_code}' -H "Cookie: __Host-forge=$c" "$PRIV/dami/secret/")" 20021n=$(node -e '22const { DatabaseSync } = require("node:sqlite");23console.log(new DatabaseSync(process.argv[1], { readOnly: true }).prepare("SELECT length(public_key) AS n FROM passkeys").get().n)' "$FORGE_ROOT/.forge/identity.db" 2>/dev/null)24[ "$n" -gt 1312 ] || fail "the stored ML-DSA-44 key is $n bytes"