@babylonjs-toolkit/server 0.0.0-stage → 9.35.1

package/lib/admin/AuthToolRoutes.js

@@ -0,0 +1,164 @@
+// The auth tool routes (game-server-admin-console DR §6.11 auth-tools rows): the player auth status with recent
+// failures, a token tester that never logs or counts the token, and a JWKS reload on every instance, plus this
+// instance's reloadAuthKeys fleet command (R15).
+import { testPlayerToken } from "../Authentication.js";
+import { AdminRequestError } from "./AdminApiRouter.js";
+import { bodyObject, optionalStringField, stringField } from "./AdminRequestBodies.js";
+import { canViewAddresses } from "./SessionRoutes.js";
+/** HTTP status of a successful read or action. */
+const HTTP_OK = 200;
+/** HTTP status of an invalid request. */
+const HTTP_BAD_REQUEST = 400;
+/** HTTP status of a tool that does not apply to this server's auth setup. */
+const HTTP_CONFLICT = 409;
+/** The log message of a refused join (JoinGate). */
+const JOIN_REFUSED_MESSAGE = "join refused";
+/** The refusal reasons that are failed token checks. */
+const AUTH_FAILURE_REASONS = new Set(["InvalidAuthentication", "AuthenticationTicketExpired", "CustomAuthenticationFailed"]);
+/** How many join-refused entries each instance is asked for. */
+const FAILURE_ENTRIES_PER_INSTANCE = 1000;
+/** How far back the failure counts look, in milliseconds. */
+const FAILURE_WINDOW_MS = 3600000;
+/** How many failing addresses the status lists. */
+const TOP_ADDRESS_COUNT = 10;
+/** What a secret that has a value shows. */
+const SECRET_SET = "set";
+/** What a secret without a value shows. */
+const SECRET_NOT_SET = "not set";
+/** The token kinds the tester accepts. */
+const TOKEN_KINDS = new Set(["session", "lobby"]);
+/**
+ * Registers the auth-tools/* routes.
+ * @param router The admin API router.
+ * @param services The shared services.
+ */
+export function registerAuthToolRoutes(router, services) {
+    const routes = [
+        { method: "GET", pattern: "auth-tools/status", permission: "auth.view", requiresStepUp: false, auditAction: null, handler: async (request) => ({ status: HTTP_OK, body: await buildAuthStatus(services, request) }) },
+        { method: "POST", pattern: "auth-tools/test-token", permission: "auth.view", requiresStepUp: false, auditAction: "auth.testToken", handler: async (request) => testToken(services, request) },
+        { method: "POST", pattern: "auth-tools/reload-keys", permission: "auth.manage", requiresStepUp: false, auditAction: "auth.reloadKeys", handler: async () => reloadKeys(services) }
+    ];
+    for (const route of routes)
+        router.register(route);
+}
+/**
+ * Registers this instance's reloadAuthKeys fleet command (R15).
+ * @param services The shared services.
+ */
+export function registerAuthToolCommands(services) {
+    services.fleet.handle("reloadAuthKeys", async () => {
+        const reload = services.state.verifier?.reloadKeys ?? null;
+        if (reload == null)
+            throw new AdminRequestError(HTTP_CONFLICT, "this instance does not load player keys from a JWKS URL");
+        await reload();
+        return null;
+    });
+}
+/**
+ * GET auth-tools/status (spec 10): the auth setup without secret values, and the failed token checks of the last hour
+ * by reason and by address (from the join-refused log entries of every instance).
+ * @param services The shared services.
+ * @param request The request (addresses only with players.viewAddresses).
+ * @returns The status.
+ */
+async function buildAuthStatus(services, request) {
+    const auth = services.config.auth;
+    const failures = await recentAuthFailures(services);
+    return {
+        enabled: auth.enabled,
+        mode: auth.mode,
+        issuer: auth.jwt.issuer,
+        audience: auth.jwt.audience,
+        jwksUrl: auth.jwt.jwksUrl,
+        jwksCacheAgeSeconds: services.state.verifier?.keyCacheAgeSeconds() ?? null,
+        webhookUrl: (auth.webhook.url != null) ? originOnly(auth.webhook.url) : null,
+        webhookTimeoutMs: auth.webhook.timeoutMs,
+        sharedSecretTokens: (auth.sharedSecret.tokens.length > 0) ? SECRET_SET : SECRET_NOT_SET,
+        jwtSecret: (auth.jwt.secret != null && auth.jwt.secret !== "") ? SECRET_SET : SECRET_NOT_SET,
+        failuresLastHour: countBy(failures, (entry) => String(entry.fields.reason)).map((counted) => ({ reason: counted.key, count: counted.count })),
+        topFailingAddresses: canViewAddresses(request) ? topAddresses(failures) : []
+    };
+}
+/**
+ * The join-refused entries of failed token checks in the last hour, across the fleet.
+ * @param services The shared services.
+ * @returns The entries.
+ */
+async function recentAuthFailures(services) {
+    const read = await services.fleet.runOnAll("readLogs", { filter: { text: JOIN_REFUSED_MESSAGE }, afterSequence: 0, limit: FAILURE_ENTRIES_PER_INSTANCE });
+    const cutoff = services.clock.now() - FAILURE_WINDOW_MS;
+    return read.results.flatMap((entry) => entry.result).filter((logEntry) => {
+        return logEntry.message === JOIN_REFUSED_MESSAGE && AUTH_FAILURE_REASONS.has(String(logEntry.fields.reason)) && Date.parse(logEntry.time) >= cutoff;
+    });
+}
+/**
+ * The addresses with the most failed token checks.
+ * @param failures The failure entries.
+ * @returns At most TOP_ADDRESS_COUNT addresses, most failures first.
+ */
+function topAddresses(failures) {
+    const withAddress = failures.filter((entry) => typeof entry.fields.clientAddress === "string");
+    return countBy(withAddress, (entry) => String(entry.fields.clientAddress)).slice(0, TOP_ADDRESS_COUNT).map((counted) => ({ address: counted.key, count: counted.count }));
+}
+/**
+ * Counts entries by a key.
+ * @param entries The entries.
+ * @param keyOf The key of an entry.
+ * @returns Each key with its count, largest count first.
+ */
+function countBy(entries, keyOf) {
+    const counts = new Map();
+    for (const entry of entries)
+        counts.set(keyOf(entry), (counts.get(keyOf(entry)) ?? 0) + 1);
+    return Array.from(counts.entries()).map(([key, count]) => ({ key: key, count: count })).sort((left, right) => right.count - left.count);
+}
+/**
+ * A URL shown as scheme://host/… only, so a path or query that carries a secret never shows.
+ * @param url The URL.
+ * @returns The shortened URL, or "(invalid URL)".
+ */
+function originOnly(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol + "//" + parsed.host + "/…";
+    }
+    catch {
+        return "(invalid URL)";
+    }
+}
+/**
+ * POST auth-tools/test-token: checks a token the way the join gate would, without counting it or logging it. The
+ * audit record never holds the token.
+ * @param services The shared services.
+ * @param request The request.
+ * @returns The outcome.
+ * @throws AdminRequestError 400 for a bad body, 409 while auth is off.
+ */
+async function testToken(services, request) {
+    const body = bodyObject(request.body);
+    const token = stringField(body, "token");
+    const kind = stringField(body, "kind");
+    if (!TOKEN_KINDS.has(kind))
+        throw new AdminRequestError(HTTP_BAD_REQUEST, "kind must be session or lobby");
+    const sessionName = optionalStringField(body, "sessionName");
+    if (services.state.verifier == null)
+        throw new AdminRequestError(HTTP_CONFLICT, "player auth is off, so joins need no token");
+    const authRequest = { token: token, kind: kind, sessionName: (kind === "session") ? sessionName : null, gameMode: null, clientAddress: request.clientAddress, origin: null };
+    const result = await testPlayerToken(services.state.verifier, authRequest);
+    const view = { accepted: result.accepted, identity: (result.identity != null) ? { userId: result.identity.userId, claims: result.identity.claims } : null, refusal: result.refusal };
+    return { status: HTTP_OK, body: view, audit: { target: kind, parameters: { sessionName: sessionName, accepted: result.accepted, refusal: result.refusal } } };
+}
+/**
+ * POST auth-tools/reload-keys: every instance fetches the JWKS again now.
+ * @param services The shared services.
+ * @returns How many instances reloaded, and each failure.
+ * @throws AdminRequestError 409 when player auth does not use a JWKS URL.
+ */
+async function reloadKeys(services) {
+    const auth = services.config.auth;
+    if (!auth.enabled || auth.mode !== "jwt" || auth.jwt.jwksUrl == null)
+        throw new AdminRequestError(HTTP_CONFLICT, "player auth does not load keys from a JWKS URL");
+    const outcome = await services.fleet.runOnAll("reloadAuthKeys", null);
+    const view = { reloadedInstances: outcome.results.length, failures: outcome.failures.map((failure) => failure.processId + ": " + failure.error) };
+    return { status: HTTP_OK, body: view, audit: { target: "fleet", parameters: { reloadedInstances: view.reloadedInstances, failures: view.failures.length } } };
+}

package/lib/admin/BanList.d.ts

@@ -0,0 +1,87 @@
+import { type Presence } from "colyseus";
+import type { BanRecord } from "./AdminRecords.js";
+/** Who a kick block refuses: the user id when the player had one, else its address (D12). */
+export interface KickSubject {
+    /** The kicked player's user id, or null when it joined anonymously. */
+    userId: string | null;
+    /** The kicked player's address. */
+    clientAddress: string;
+}
+/**
+ * Whether a ban is in force at a time.
+ * @param record The ban.
+ * @param nowMilliseconds The time.
+ * @returns True for a permanent ban or one that ends later.
+ */
+export declare function isBanActive(record: BanRecord, nowMilliseconds: number): boolean;
+/**
+ * The refusal detail of a ban (D15).
+ * @param record The ban.
+ * @returns "you are banned until <ISO time>" or "you are banned permanently".
+ */
+export declare function banRefusalDetail(record: BanRecord): string;
+/** The bans of this instance, as the join gate checks them. */
+export declare class BanList {
+    /** The current time, in milliseconds (the admin clock). */
+    private readonly now;
+    /** Address and network bans. */
+    private addressBans;
+    /** User-id bans by user id. */
+    private userBans;
+    /**
+     * Starts empty; reload() fills it.
+     * @param now The current time, in milliseconds.
+     */
+    constructor(now: () => number);
+    /**
+     * Replaces the bans; records already expired are dropped and unreadable ranges are skipped.
+     * @param records Every stored ban.
+     */
+    reload(records: BanRecord[]): void;
+    /**
+     * The ban in force on an address, by address or by range.
+     * @param clientAddress The client's address.
+     * @returns The ban, or null.
+     */
+    addressBan(clientAddress: string): BanRecord | null;
+    /**
+     * The ban in force on a user id.
+     * @param userId The verified user id.
+     * @returns The ban, or null.
+     */
+    userBan(userId: string): BanRecord | null;
+    /**
+     * The ban in force on a player, by user id or by address.
+     * @param userId The player's user id, or null.
+     * @param clientAddress The player's address.
+     * @returns The ban, or null.
+     */
+    playerBan(userId: string | null, clientAddress: string): BanRecord | null;
+}
+/** Recently kicked players per session name, kept in presence for KICK_REJOIN_BLOCK_SECONDS (D12, R19). */
+export declare class KickBlockList {
+    /** The fleet's presence (read on each call: Colyseus sets it when the server listens). */
+    private readonly presence;
+    /**
+     * Creates the list.
+     * @param presence Returns the fleet's presence.
+     */
+    constructor(presence: () => Presence);
+    /**
+     * Refuses a kicked player's fresh joins to one session for a while: by user id, or by address when anonymous. The
+     * value is the block's end time, so a read can tell an expired block. Redis expires the key itself; local presence
+     * gets a plain key, because its expiry timer would keep a closed server's process alive for the whole block.
+     * @param sessionName The session it was kicked from.
+     * @param subject Who was kicked.
+     * @param seconds How long the block lasts.
+     */
+    block(sessionName: string, subject: KickSubject, seconds: number): Promise<void>;
+    /**
+     * Whether a join to a session is blocked by a kick of its user id or of its address.
+     * @param sessionName The session.
+     * @param userId The joiner's verified user id, or null.
+     * @param clientAddress The joiner's address.
+     * @returns True when blocked.
+     */
+    isBlocked(sessionName: string, userId: string | null, clientAddress: string): Promise<boolean>;
+}

package/lib/admin/BanList.js

@@ -0,0 +1,152 @@
+// Bans and kick blocks the join gate enforces (game-server-admin-console D12, D15, DR §6.4, §13 R19). The BanList is
+// rebuilt from the store's "bans" collection on start and on every change announcement; kick blocks live in presence,
+// so a kicked player is refused on every instance.
+import { LocalPresence } from "colyseus";
+import { BlockList } from "node:net";
+import { addNetworkEntry, isAddressInList, normalizeAddress } from "../NetworkAddresses.js";
+/** Presence key prefix of kick blocks (R19). */
+const KICK_BLOCK_KEY_PREFIX = "bgs:kick:";
+/** Milliseconds per second. */
+const MILLISECONDS_PER_SECOND = 1000;
+/**
+ * Whether a ban is in force at a time.
+ * @param record The ban.
+ * @param nowMilliseconds The time.
+ * @returns True for a permanent ban or one that ends later.
+ */
+export function isBanActive(record, nowMilliseconds) {
+    return record.expiresAt == null || Date.parse(record.expiresAt) > nowMilliseconds;
+}
+/**
+ * The refusal detail of a ban (D15).
+ * @param record The ban.
+ * @returns "you are banned until <ISO time>" or "you are banned permanently".
+ */
+export function banRefusalDetail(record) {
+    return (record.expiresAt != null) ? "you are banned until " + record.expiresAt : "you are banned permanently";
+}
+/** The bans of this instance, as the join gate checks them. */
+export class BanList {
+    /** The current time, in milliseconds (the admin clock). */
+    now;
+    /** Address and network bans. */
+    addressBans = [];
+    /** User-id bans by user id. */
+    userBans = new Map();
+    /**
+     * Starts empty; reload() fills it.
+     * @param now The current time, in milliseconds.
+     */
+    constructor(now) {
+        this.now = now;
+    }
+    /**
+     * Replaces the bans; records already expired are dropped and unreadable ranges are skipped.
+     * @param records Every stored ban.
+     */
+    reload(records) {
+        const now = this.now();
+        const active = records.filter((record) => isBanActive(record, now));
+        this.userBans = new Map(active.filter((record) => record.kind === "user").map((record) => [record.value, record]));
+        this.addressBans = active.filter((record) => record.kind !== "user").map(createAddressEntry).filter((entry) => entry != null);
+    }
+    /**
+     * The ban in force on an address, by address or by range.
+     * @param clientAddress The client's address.
+     * @returns The ban, or null.
+     */
+    addressBan(clientAddress) {
+        const now = this.now();
+        const entry = this.addressBans.find((candidate) => isBanActive(candidate.record, now) && isAddressInList(candidate.matcher, clientAddress));
+        return entry?.record ?? null;
+    }
+    /**
+     * The ban in force on a user id.
+     * @param userId The verified user id.
+     * @returns The ban, or null.
+     */
+    userBan(userId) {
+        const record = this.userBans.get(userId);
+        return (record != null && isBanActive(record, this.now())) ? record : null;
+    }
+    /**
+     * The ban in force on a player, by user id or by address.
+     * @param userId The player's user id, or null.
+     * @param clientAddress The player's address.
+     * @returns The ban, or null.
+     */
+    playerBan(userId, clientAddress) {
+        return ((userId != null) ? this.userBan(userId) : null) ?? this.addressBan(clientAddress);
+    }
+}
+/**
+ * The block list entry of an address or network ban.
+ * @param record The ban.
+ * @returns The entry, or null when the value is not an address or range.
+ */
+function createAddressEntry(record) {
+    const matcher = new BlockList();
+    return addNetworkEntry(matcher, record.value) ? { record: record, matcher: matcher } : null;
+}
+/** Recently kicked players per session name, kept in presence for KICK_REJOIN_BLOCK_SECONDS (D12, R19). */
+export class KickBlockList {
+    /** The fleet's presence (read on each call: Colyseus sets it when the server listens). */
+    presence;
+    /**
+     * Creates the list.
+     * @param presence Returns the fleet's presence.
+     */
+    constructor(presence) {
+        this.presence = presence;
+    }
+    /**
+     * Refuses a kicked player's fresh joins to one session for a while: by user id, or by address when anonymous. The
+     * value is the block's end time, so a read can tell an expired block. Redis expires the key itself; local presence
+     * gets a plain key, because its expiry timer would keep a closed server's process alive for the whole block.
+     * @param sessionName The session it was kicked from.
+     * @param subject Who was kicked.
+     * @param seconds How long the block lasts.
+     */
+    async block(sessionName, subject, seconds) {
+        const key = (subject.userId != null) ? userKey(sessionName, subject.userId) : addressKey(sessionName, subject.clientAddress);
+        const endsAt = String(Date.now() + seconds * MILLISECONDS_PER_SECOND);
+        const presence = this.presence();
+        if (presence instanceof LocalPresence)
+            await presence.set(key, endsAt);
+        else
+            await presence.setex(key, endsAt, seconds);
+    }
+    /**
+     * Whether a join to a session is blocked by a kick of its user id or of its address.
+     * @param sessionName The session.
+     * @param userId The joiner's verified user id, or null.
+     * @param clientAddress The joiner's address.
+     * @returns True when blocked.
+     */
+    async isBlocked(sessionName, userId, clientAddress) {
+        const keys = [addressKey(sessionName, clientAddress)];
+        if (userId != null)
+            keys.push(userKey(sessionName, userId));
+        const values = await Promise.all(keys.map((key) => this.presence().get(key)));
+        const now = Date.now();
+        return values.some((value) => value != null && Number(value) > now);
+    }
+}
+/**
+ * The presence key of a user-id kick block.
+ * @param sessionName The session.
+ * @param userId The user id.
+ * @returns The key.
+ */
+function userKey(sessionName, userId) {
+    return KICK_BLOCK_KEY_PREFIX + sessionName + ":user:" + userId;
+}
+/**
+ * The presence key of an address kick block.
+ * @param sessionName The session.
+ * @param clientAddress The address (normalized, so IPv4-mapped forms match).
+ * @returns The key.
+ */
+function addressKey(sessionName, clientAddress) {
+    return KICK_BLOCK_KEY_PREFIX + sessionName + ":address:" + normalizeAddress(clientAddress);
+}

package/lib/admin/CborDecoder.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Decodes exactly one CBOR item.
+ * @param bytes The encoded item.
+ * @returns The value: numbers, Uint8Array byte strings, strings, arrays, Map objects, booleans or null.
+ * @throws Error "unsupported CBOR" for unsupported types, indefinite lengths, truncated input or trailing bytes.
+ */
+export declare function decodeCbor(bytes: Uint8Array): unknown;
+/**
+ * Decodes the first CBOR item of some bytes and says where it ends (the credential public key inside authenticator
+ * data is followed by extension data).
+ * @param bytes The bytes, starting with an item.
+ * @returns The value and the number of bytes it took.
+ * @throws Error "unsupported CBOR" for an unsupported or truncated item.
+ */
+export declare function decodeCborPrefix(bytes: Uint8Array): {
+    value: unknown;
+    byteLength: number;
+};

package/lib/admin/CborDecoder.js

@@ -0,0 +1,201 @@
+// A minimal CBOR decoder (RFC 8949) for passkey attestation objects and COSE keys (game-server-admin-console D31): major
+// types 0–5 and the simple values false, true and null of major type 7, definite lengths only. Maps become Map objects
+// so integer keys (COSE labels) keep their type. Anything else is refused.
+/** Major types of the initial byte's top three bits. */
+const MAJOR_UNSIGNED = 0;
+const MAJOR_NEGATIVE = 1;
+const MAJOR_BYTES = 2;
+const MAJOR_TEXT = 3;
+const MAJOR_ARRAY = 4;
+const MAJOR_MAP = 5;
+const MAJOR_SIMPLE = 7;
+/** Additional information values: 0–23 are the value itself; 24–27 a following 1, 2, 4 or 8 byte argument. */
+const DIRECT_ARGUMENT_MAX = 23;
+const ONE_BYTE_ARGUMENT = 24;
+const TWO_BYTE_ARGUMENT = 25;
+const FOUR_BYTE_ARGUMENT = 26;
+const EIGHT_BYTE_ARGUMENT = 27;
+/** Simple values of major type 7. */
+const SIMPLE_FALSE = 20;
+const SIMPLE_TRUE = 21;
+const SIMPLE_NULL = 22;
+/** Bits of the major type and the additional information in the initial byte. */
+const MAJOR_TYPE_SHIFT = 5;
+const ADDITIONAL_INFORMATION_MASK = 0x1f;
+/** The error every unsupported or malformed input throws. */
+const UNSUPPORTED_MESSAGE = "unsupported CBOR";
+/** Reads one CBOR item after another from a byte array. */
+class CborReader {
+    /** The input. */
+    bytes;
+    /** A view of the input for multi-byte arguments. */
+    view;
+    /** The next byte to read. */
+    offset = 0;
+    /**
+     * Starts at the first byte.
+     * @param bytes The input.
+     */
+    constructor(bytes) {
+        this.bytes = bytes;
+        this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    }
+    /** True once every byte was read. */
+    get isAtEnd() {
+        return this.offset === this.bytes.byteLength;
+    }
+    /** How many bytes were read so far. */
+    get bytesRead() {
+        return this.offset;
+    }
+    /**
+     * Reads one item.
+     * @returns The decoded value.
+     * @throws Error "unsupported CBOR" for an unsupported or truncated item.
+     */
+    readItem() {
+        const initialByte = this.readUint8();
+        const majorType = initialByte >> MAJOR_TYPE_SHIFT;
+        const additionalInformation = initialByte & ADDITIONAL_INFORMATION_MASK;
+        if (majorType === MAJOR_SIMPLE)
+            return simpleValueOf(additionalInformation);
+        const argument = this.readArgument(additionalInformation);
+        switch (majorType) {
+            case MAJOR_UNSIGNED:
+                return argument;
+            case MAJOR_NEGATIVE:
+                return -1 - argument;
+            case MAJOR_BYTES:
+                return this.readBytes(argument).slice();
+            case MAJOR_TEXT:
+                return new TextDecoder("utf-8", { fatal: true }).decode(this.readBytes(argument));
+            case MAJOR_ARRAY:
+                return this.readArray(argument);
+            case MAJOR_MAP:
+                return this.readMap(argument);
+            default:
+                throw new Error(UNSUPPORTED_MESSAGE);
+        }
+    }
+    /**
+     * Reads the argument an item's additional information announces.
+     * @param additionalInformation The low five bits of the initial byte.
+     * @returns The argument (a length or an integer).
+     * @throws Error "unsupported CBOR" for indefinite lengths, reserved values or integers above 2^53 − 1.
+     */
+    readArgument(additionalInformation) {
+        if (additionalInformation <= DIRECT_ARGUMENT_MAX)
+            return additionalInformation;
+        if (additionalInformation === ONE_BYTE_ARGUMENT)
+            return this.readUint8();
+        if (additionalInformation === TWO_BYTE_ARGUMENT)
+            return this.readFixed(2, () => this.view.getUint16(this.offset));
+        if (additionalInformation === FOUR_BYTE_ARGUMENT)
+            return this.readFixed(4, () => this.view.getUint32(this.offset));
+        if (additionalInformation !== EIGHT_BYTE_ARGUMENT)
+            throw new Error(UNSUPPORTED_MESSAGE);
+        const wide = this.readFixed(8, () => this.view.getBigUint64(this.offset));
+        if (wide > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new Error(UNSUPPORTED_MESSAGE);
+        return Number(wide);
+    }
+    /**
+     * Reads a definite-length array.
+     * @param length The number of items.
+     * @returns The items.
+     */
+    readArray(length) {
+        const items = [];
+        for (let i = 0; i < length; i++)
+            items.push(this.readItem());
+        return items;
+    }
+    /**
+     * Reads a definite-length map.
+     * @param length The number of pairs.
+     * @returns The pairs, keys of any type.
+     */
+    readMap(length) {
+        const map = new Map();
+        for (let i = 0; i < length; i++) {
+            const key = this.readItem();
+            map.set(key, this.readItem());
+        }
+        return map;
+    }
+    /**
+     * Reads one byte.
+     * @returns The byte.
+     * @throws Error "unsupported CBOR" past the end.
+     */
+    readUint8() {
+        return this.readFixed(1, () => this.view.getUint8(this.offset));
+    }
+    /**
+     * Reads a fixed-size big-endian value and moves past it.
+     * @param size Its size in bytes.
+     * @param read Reads it at the current offset.
+     * @returns The value.
+     * @throws Error "unsupported CBOR" when the input is too short.
+     */
+    readFixed(size, read) {
+        if (this.offset + size > this.bytes.byteLength)
+            throw new Error(UNSUPPORTED_MESSAGE);
+        const value = read();
+        this.offset += size;
+        return value;
+    }
+    /**
+     * Reads some bytes and moves past them.
+     * @param length How many.
+     * @returns A view of them.
+     * @throws Error "unsupported CBOR" when the input is too short.
+     */
+    readBytes(length) {
+        if (this.offset + length > this.bytes.byteLength)
+            throw new Error(UNSUPPORTED_MESSAGE);
+        const slice = this.bytes.subarray(this.offset, this.offset + length);
+        this.offset += length;
+        return slice;
+    }
+}
+/**
+ * The simple value of a major type 7 item.
+ * @param additionalInformation The low five bits.
+ * @returns false, true or null.
+ * @throws Error "unsupported CBOR" for floats, undefined and other simple values.
+ */
+function simpleValueOf(additionalInformation) {
+    if (additionalInformation === SIMPLE_FALSE)
+        return false;
+    if (additionalInformation === SIMPLE_TRUE)
+        return true;
+    if (additionalInformation === SIMPLE_NULL)
+        return null;
+    throw new Error(UNSUPPORTED_MESSAGE);
+}
+/**
+ * Decodes exactly one CBOR item.
+ * @param bytes The encoded item.
+ * @returns The value: numbers, Uint8Array byte strings, strings, arrays, Map objects, booleans or null.
+ * @throws Error "unsupported CBOR" for unsupported types, indefinite lengths, truncated input or trailing bytes.
+ */
+export function decodeCbor(bytes) {
+    const reader = new CborReader(bytes);
+    const value = reader.readItem();
+    if (!reader.isAtEnd)
+        throw new Error(UNSUPPORTED_MESSAGE);
+    return value;
+}
+/**
+ * Decodes the first CBOR item of some bytes and says where it ends (the credential public key inside authenticator
+ * data is followed by extension data).
+ * @param bytes The bytes, starting with an item.
+ * @returns The value and the number of bytes it took.
+ * @throws Error "unsupported CBOR" for an unsupported or truncated item.
+ */
+export function decodeCborPrefix(bytes) {
+    const reader = new CborReader(bytes);
+    const value = reader.readItem();
+    return { value: value, byteLength: reader.bytesRead };
+}