@freqhole/haruspex 0.0.0

package/dist/webauthn/ceremony.d.ts

@@ -0,0 +1,76 @@
+import type { AuthOutcome, WebauthnTransport, WhoamiOutcome } from "./transport.js";
+export type CeremonyResult = ({
+    success: true;
+} & AuthOutcome) | CeremonyFailure;
+/**
+ * a failed ceremony. `error` is always a human-readable message, matching
+ * the shape callers already relied on. `name` and `cause` are populated
+ * only when the failure came from a thrown value (e.g. the browser's own
+ * `DOMException` from `navigator.credentials.create`/`.get`) rather than a
+ * transport-reported failure (`start.error`/`finish.error`, which carry no
+ * such name) - so callers can distinguish "user cancelled"
+ * (`NotAllowedError`) from "passkeys not supported" (`NotSupportedError`)
+ * from a plain transport error, instead of pattern-matching the message
+ * string.
+ */
+export interface CeremonyFailure {
+    success: false;
+    error: string;
+    /** the thrown value's `name`, if it has one (e.g. a `DOMException`'s
+     *  `NotAllowedError`/`NotSupportedError`, or `Error`'s own `name`). */
+    name?: string;
+    /** the original thrown value, for callers that need more than `name`. */
+    cause?: unknown;
+}
+/** creates a new passkey credential; defaults to `navigator.credentials.create`. */
+export type CreateCredentialFn = (options: CredentialCreationOptions) => Promise<PublicKeyCredential | null>;
+/** asserts an existing passkey credential; defaults to `navigator.credentials.get`. */
+export type GetCredentialFn = (options: CredentialRequestOptions) => Promise<PublicKeyCredential | null>;
+export interface PasskeyCeremonyDeps {
+    createCredential?: CreateCredentialFn;
+    getCredential?: GetCredentialFn;
+    /** the origin reported to the server; defaults to `window.location.origin`. */
+    origin?: string;
+}
+export interface RegisterPasskeyArgs {
+    username: string;
+    /** required unless the caller already has an authenticated device link
+     *  to the target identity. */
+    inviteCode?: string;
+}
+/**
+ * register a new passkey: start the ceremony, prompt the browser to create
+ * a credential, then finish it.
+ *
+ * the p2p/http transport difference (nonce threading vs a session cookie)
+ * lives entirely in the injected `transport` - this function's logic is the
+ * same either way.
+ */
+export declare function registerWithPasskey(transport: WebauthnTransport, args: RegisterPasskeyArgs, deps?: PasskeyCeremonyDeps): Promise<CeremonyResult>;
+export interface LoginPasskeyArgs {
+    /** omit for the discoverable-credential flow. */
+    username?: string;
+}
+/**
+ * authenticate with an existing passkey: start the ceremony, prompt the
+ * browser for an assertion, then finish it.
+ */
+export declare function loginWithPasskey(transport: WebauthnTransport, args?: LoginPasskeyArgs, deps?: PasskeyCeremonyDeps): Promise<CeremonyResult>;
+export interface AuthenticateArgs {
+    username: string;
+    inviteCode?: string;
+    mode: "login" | "register";
+}
+/** unified login-or-register dispatch, driven by `args.mode`. */
+export declare function authenticate(transport: WebauthnTransport, args: AuthenticateArgs, deps?: PasskeyCeremonyDeps): Promise<CeremonyResult>;
+/**
+ * check whether the caller is already authenticated to a remote.
+ *
+ * unlike the register/login ceremonies above, this does not swallow
+ * transport errors - callers need to distinguish "not authenticated"
+ * (`{ authenticated: false }`) from "the transport itself isn't ready yet"
+ * (a thrown error), so they can retry the latter instead of treating it as
+ * a login prompt.
+ */
+export declare function whoami(transport: WebauthnTransport): Promise<WhoamiOutcome>;
+//# sourceMappingURL=ceremony.d.ts.map

package/dist/webauthn/ceremony.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceremony.d.ts","sourceRoot":"","sources":["../../src/webauthn/ceremony.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,aAAa,EACd,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,cAAc,GACtB,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG,WAAW,CAAC,GACjC,eAAe,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;2EACuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAmBD,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;AAEzC,uFAAuF;AACvF,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;AAEzC,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA8BD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,mBAAmB,EACzB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,iBAAiB,EAC5B,IAAI,GAAE,gBAAqB,EAC3B,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA6BzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;CAC5B;AAED,iEAAiE;AACjE,wBAAsB,YAAY,CAChC,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAezB;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3E"}

package/dist/webauthn/ceremony.js

@@ -0,0 +1,136 @@
+// transport-injected ceremony runners: the pure register/login logic that
+// used to be duplicated per transport (http session cookies vs p2p nonces)
+// now runs once against the WebauthnTransport interface.
+import { prepareAuthenticationOptions, prepareRegistrationOptions, serializeAuthenticationCredential, serializeRegistrationCredential, } from "./codec.js";
+/** builds a `CeremonyFailure` from a value thrown by a browser api call
+ *  (`navigator.credentials.create`/`.get`), preserving its `name`/`message`
+ *  when present instead of collapsing every failure into one string. */
+function ceremonyFailureFromThrown(err, fallbackMessage) {
+    if (err && typeof err === "object") {
+        const record = err;
+        const name = typeof record.name === "string" ? record.name : undefined;
+        const message = typeof record.message === "string" ? record.message : fallbackMessage;
+        return { success: false, error: message, name, cause: err };
+    }
+    return { success: false, error: fallbackMessage, cause: err };
+}
+function resolveOrigin(deps) {
+    if (deps.origin)
+        return deps.origin;
+    if (typeof window !== "undefined" && window.location) {
+        return window.location.origin;
+    }
+    throw new Error("no origin available outside a browser context - pass deps.origin");
+}
+function resolveCreateCredential(deps) {
+    if (deps.createCredential)
+        return deps.createCredential;
+    if (typeof navigator === "undefined" || !navigator.credentials) {
+        throw new Error("webauthn is not available in this environment");
+    }
+    return (options) => navigator.credentials.create(options);
+}
+function resolveGetCredential(deps) {
+    if (deps.getCredential)
+        return deps.getCredential;
+    if (typeof navigator === "undefined" || !navigator.credentials) {
+        throw new Error("webauthn is not available in this environment");
+    }
+    return (options) => navigator.credentials.get(options);
+}
+/**
+ * register a new passkey: start the ceremony, prompt the browser to create
+ * a credential, then finish it.
+ *
+ * the p2p/http transport difference (nonce threading vs a session cookie)
+ * lives entirely in the injected `transport` - this function's logic is the
+ * same either way.
+ */
+export async function registerWithPasskey(transport, args, deps = {}) {
+    try {
+        const origin = resolveOrigin(deps);
+        const createCredential = resolveCreateCredential(deps);
+        const start = await transport.registerStart({
+            username: args.username,
+            origin,
+            inviteCode: args.inviteCode,
+        });
+        if (!start.success)
+            return { success: false, error: start.error };
+        const options = prepareRegistrationOptions(start.data.challenge);
+        const credential = await createCredential(options);
+        if (!credential) {
+            return { success: false, error: "browser did not return a credential" };
+        }
+        const serialized = serializeRegistrationCredential(credential);
+        const finish = await transport.registerFinish({
+            nonce: start.data.nonce,
+            origin,
+            credential: serialized,
+        });
+        if (!finish.success)
+            return { success: false, error: finish.error };
+        return { success: true, ...finish.data };
+    }
+    catch (err) {
+        return ceremonyFailureFromThrown(err, "registration failed");
+    }
+}
+/**
+ * authenticate with an existing passkey: start the ceremony, prompt the
+ * browser for an assertion, then finish it.
+ */
+export async function loginWithPasskey(transport, args = {}, deps = {}) {
+    try {
+        const origin = resolveOrigin(deps);
+        const getCredential = resolveGetCredential(deps);
+        const start = await transport.loginStart({
+            username: args.username,
+            origin,
+        });
+        if (!start.success)
+            return { success: false, error: start.error };
+        const options = prepareAuthenticationOptions(start.data.challenge);
+        const credential = await getCredential(options);
+        if (!credential) {
+            return { success: false, error: "browser did not return a credential" };
+        }
+        const serialized = serializeAuthenticationCredential(credential);
+        const finish = await transport.loginFinish({
+            nonce: start.data.nonce,
+            origin,
+            credential: serialized,
+        });
+        if (!finish.success)
+            return { success: false, error: finish.error };
+        return { success: true, ...finish.data };
+    }
+    catch (err) {
+        return ceremonyFailureFromThrown(err, "login failed");
+    }
+}
+/** unified login-or-register dispatch, driven by `args.mode`. */
+export async function authenticate(transport, args, deps = {}) {
+    if (args.mode === "register") {
+        if (!args.inviteCode) {
+            return {
+                success: false,
+                error: "invite code required for registration",
+            };
+        }
+        return registerWithPasskey(transport, { username: args.username, inviteCode: args.inviteCode }, deps);
+    }
+    return loginWithPasskey(transport, { username: args.username }, deps);
+}
+/**
+ * check whether the caller is already authenticated to a remote.
+ *
+ * unlike the register/login ceremonies above, this does not swallow
+ * transport errors - callers need to distinguish "not authenticated"
+ * (`{ authenticated: false }`) from "the transport itself isn't ready yet"
+ * (a thrown error), so they can retry the latter instead of treating it as
+ * a login prompt.
+ */
+export function whoami(transport) {
+    return transport.whoami();
+}

package/dist/webauthn/ceremony.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ceremony.test.d.ts.map

package/dist/webauthn/ceremony.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceremony.test.d.ts","sourceRoot":"","sources":["../../src/webauthn/ceremony.test.ts"],"names":[],"mappings":""}

package/dist/webauthn/ceremony.test.js

@@ -0,0 +1,245 @@
+import { describe, expect, it, vi } from "vitest";
+import { authenticate, loginWithPasskey, registerWithPasskey, whoami, } from "./ceremony.js";
+const REGISTRATION_CHALLENGE = {
+    publicKey: {
+        rp: { name: "freqhole" },
+        user: { id: "AA", name: "alice", displayName: "Alice" },
+        challenge: "AQ",
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+    },
+};
+const AUTHENTICATION_CHALLENGE = {
+    publicKey: { challenge: "AQ" },
+};
+const FAKE_CREDENTIAL = {
+    id: "cred-id",
+    rawId: new Uint8Array([1]).buffer,
+    response: {},
+};
+/** a scriptable stand-in for a real http/p2p webauthn transport. */
+function fakeTransport(overrides = {}) {
+    return {
+        registerStart: vi.fn(async (_req) => ({
+            success: true,
+            data: { nonce: "nonce-1", challenge: REGISTRATION_CHALLENGE },
+        })),
+        registerFinish: vi.fn(async (_req) => ({
+            success: true,
+            data: { userId: "user-1", username: "alice" },
+        })),
+        loginStart: vi.fn(async (_req) => ({
+            success: true,
+            data: { nonce: "nonce-2", challenge: AUTHENTICATION_CHALLENGE },
+        })),
+        loginFinish: vi.fn(async (_req) => ({
+            success: true,
+            data: { userId: "user-1", username: "alice" },
+        })),
+        whoami: vi.fn(async () => ({ authenticated: false })),
+        ...overrides,
+    };
+}
+const deps = {
+    origin: "https://example.test",
+    createCredential: vi.fn(async () => FAKE_CREDENTIAL),
+    getCredential: vi.fn(async () => FAKE_CREDENTIAL),
+};
+describe("registerWithPasskey", () => {
+    it("runs start -> browser create -> finish and returns the outcome", async () => {
+        const transport = fakeTransport();
+        const createCredential = vi.fn(async () => FAKE_CREDENTIAL);
+        const result = await registerWithPasskey(transport, { username: "alice", inviteCode: "invite-1" }, { origin: deps.origin, createCredential });
+        expect(result).toEqual({
+            success: true,
+            userId: "user-1",
+            username: "alice",
+        });
+        expect(transport.registerStart).toHaveBeenCalledWith({
+            username: "alice",
+            origin: deps.origin,
+            inviteCode: "invite-1",
+        });
+        expect(createCredential).toHaveBeenCalledOnce();
+        expect(transport.registerFinish).toHaveBeenCalledWith({
+            nonce: "nonce-1",
+            origin: deps.origin,
+            credential: expect.objectContaining({ id: "cred-id" }),
+        });
+    });
+    it("propagates a registerStart failure without calling the browser", async () => {
+        const createCredential = vi.fn(async () => FAKE_CREDENTIAL);
+        const transport = fakeTransport({
+            registerStart: vi.fn(async () => ({
+                success: false,
+                error: "username taken",
+            })),
+        });
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential });
+        expect(result).toEqual({ success: false, error: "username taken" });
+        expect(createCredential).not.toHaveBeenCalled();
+    });
+    it("fails when the browser returns no credential", async () => {
+        const transport = fakeTransport();
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential: vi.fn(async () => null) });
+        expect(result).toEqual({
+            success: false,
+            error: "browser did not return a credential",
+        });
+        expect(transport.registerFinish).not.toHaveBeenCalled();
+    });
+    it("propagates a registerFinish failure", async () => {
+        const transport = fakeTransport({
+            registerFinish: vi.fn(async () => ({
+                success: false,
+                error: "invalid credential",
+            })),
+        });
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential: vi.fn(async () => FAKE_CREDENTIAL) });
+        expect(result).toEqual({ success: false, error: "invalid credential" });
+    });
+    it("turns a thrown DOMException into a failure result carrying its name and itself as cause", async () => {
+        const transport = fakeTransport();
+        const thrown = new DOMException("user cancelled", "NotAllowedError");
+        const createCredential = vi.fn(async () => {
+            throw thrown;
+        });
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential });
+        expect(result).toEqual({
+            success: false,
+            error: "user cancelled",
+            name: "NotAllowedError",
+            cause: thrown,
+        });
+    });
+    it("turns a thrown plain Error into a failure result carrying its name and itself as cause", async () => {
+        const transport = fakeTransport();
+        const thrown = new Error("boom");
+        const createCredential = vi.fn(async () => {
+            throw thrown;
+        });
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential });
+        expect(result).toEqual({
+            success: false,
+            error: "boom",
+            name: "Error",
+            cause: thrown,
+        });
+    });
+    it("falls back to a generic message and no name for a non-error thrown value", async () => {
+        const transport = fakeTransport();
+        const createCredential = vi.fn(async () => {
+            // eslint-disable-next-line @typescript-eslint/only-throw-error
+            throw "nope";
+        });
+        const result = await registerWithPasskey(transport, { username: "alice" }, { origin: deps.origin, createCredential });
+        expect(result).toEqual({
+            success: false,
+            error: "registration failed",
+            cause: "nope",
+        });
+    });
+});
+describe("loginWithPasskey", () => {
+    it("runs start -> browser get -> finish and returns the outcome", async () => {
+        const transport = fakeTransport();
+        const getCredential = vi.fn(async () => FAKE_CREDENTIAL);
+        const result = await loginWithPasskey(transport, { username: "alice" }, { origin: deps.origin, getCredential });
+        expect(result).toEqual({
+            success: true,
+            userId: "user-1",
+            username: "alice",
+        });
+        expect(transport.loginStart).toHaveBeenCalledWith({
+            username: "alice",
+            origin: deps.origin,
+        });
+        expect(transport.loginFinish).toHaveBeenCalledWith({
+            nonce: "nonce-2",
+            origin: deps.origin,
+            credential: expect.objectContaining({ id: "cred-id" }),
+        });
+    });
+    it("supports the discoverable flow (no username)", async () => {
+        const transport = fakeTransport();
+        await loginWithPasskey(transport, {}, { origin: deps.origin, getCredential: vi.fn(async () => FAKE_CREDENTIAL) });
+        expect(transport.loginStart).toHaveBeenCalledWith({
+            username: undefined,
+            origin: deps.origin,
+        });
+    });
+    it("fails when the browser returns no assertion", async () => {
+        const transport = fakeTransport();
+        const result = await loginWithPasskey(transport, { username: "alice" }, { origin: deps.origin, getCredential: vi.fn(async () => null) });
+        expect(result).toEqual({
+            success: false,
+            error: "browser did not return a credential",
+        });
+    });
+    it("turns a thrown DOMException into a failure result carrying its name and itself as cause", async () => {
+        const transport = fakeTransport();
+        const thrown = new DOMException("no authenticator available", "NotSupportedError");
+        const getCredential = vi.fn(async () => {
+            throw thrown;
+        });
+        const result = await loginWithPasskey(transport, { username: "alice" }, { origin: deps.origin, getCredential });
+        expect(result).toEqual({
+            success: false,
+            error: "no authenticator available",
+            name: "NotSupportedError",
+            cause: thrown,
+        });
+    });
+});
+describe("authenticate", () => {
+    it("dispatches to registerWithPasskey in register mode", async () => {
+        const transport = fakeTransport();
+        const result = await authenticate(transport, { username: "alice", inviteCode: "invite-1", mode: "register" }, { origin: deps.origin, createCredential: vi.fn(async () => FAKE_CREDENTIAL) });
+        expect(result.success).toBe(true);
+        expect(transport.registerStart).toHaveBeenCalled();
+    });
+    it("requires an invite code for register mode", async () => {
+        const transport = fakeTransport();
+        const result = await authenticate(transport, {
+            username: "alice",
+            mode: "register",
+        });
+        expect(result).toEqual({
+            success: false,
+            error: "invite code required for registration",
+        });
+        expect(transport.registerStart).not.toHaveBeenCalled();
+    });
+    it("dispatches to loginWithPasskey in login mode", async () => {
+        const transport = fakeTransport();
+        const result = await authenticate(transport, { username: "alice", mode: "login" }, { origin: deps.origin, getCredential: vi.fn(async () => FAKE_CREDENTIAL) });
+        expect(result.success).toBe(true);
+        expect(transport.loginStart).toHaveBeenCalled();
+    });
+});
+describe("whoami", () => {
+    it("passes the transport's outcome straight through", async () => {
+        const transport = fakeTransport({
+            whoami: vi.fn(async () => ({
+                authenticated: true,
+                userId: "user-1",
+                username: "alice",
+                role: "admin",
+            })),
+        });
+        const result = await whoami(transport);
+        expect(result).toEqual({
+            authenticated: true,
+            userId: "user-1",
+            username: "alice",
+            role: "admin",
+        });
+    });
+    it("does not swallow a transport error - it propagates for the caller to retry", async () => {
+        const transport = fakeTransport({
+            whoami: vi.fn(async () => {
+                throw new Error("p2p transport not warm yet");
+            }),
+        });
+        await expect(whoami(transport)).rejects.toThrow("p2p transport not warm yet");
+    });
+});

package/dist/webauthn/codec.d.ts

@@ -0,0 +1,39 @@
+import { type AuthenticationChallenge, type AuthenticationPublicKeyCredential, type RegisterPublicKeyCredential, type RegistrationChallenge } from "./types.js";
+/**
+ * convert a base64url string to a Uint8Array.
+ * handles both standard base64 and base64url encoding.
+ */
+export declare function base64ToUint8Array(base64: string): Uint8Array<ArrayBuffer>;
+/**
+ * convert a Uint8Array to a base64url string (no padding, `-` instead of
+ * `+`, `_` instead of `/`).
+ */
+export declare function uint8ArrayToBase64(uint8Array: Uint8Array): string;
+/** convert an ArrayBuffer to a base64url string. */
+export declare function arrayBufferToBase64(buffer: ArrayBuffer): string;
+/**
+ * convert the server's registration challenge into browser-compatible
+ * options for `navigator.credentials.create()`, converting base64url
+ * fields to the raw bytes the browser api expects.
+ */
+export declare function prepareRegistrationOptions(challenge: RegistrationChallenge): CredentialCreationOptions;
+/**
+ * convert the server's authentication challenge into browser-compatible
+ * options for `navigator.credentials.get()`.
+ */
+export declare function prepareAuthenticationOptions(challenge: AuthenticationChallenge): CredentialRequestOptions;
+/**
+ * convert a browser registration credential into the server-compatible
+ * wire format for a `register_finish` call, validating the result against
+ * the schema.
+ */
+export declare function serializeRegistrationCredential(credential: PublicKeyCredential): RegisterPublicKeyCredential;
+/**
+ * convert a browser authentication assertion into the server-compatible
+ * wire format for a `login_finish` call, validating the result against the
+ * schema.
+ */
+export declare function serializeAuthenticationCredential(credential: PublicKeyCredential): AuthenticationPublicKeyCredential;
+/** check whether the webauthn create() api is available in this context. */
+export declare function isWebAuthnAvailable(): boolean;
+//# sourceMappingURL=codec.d.ts.map

package/dist/webauthn/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/webauthn/codec.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAQ1E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CASjE;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,qBAAqB,GAC/B,yBAAyB,CAgB3B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,uBAAuB,GACjC,wBAAwB,CAY1B;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,mBAAmB,GAC9B,2BAA2B,CAW7B;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,mBAAmB,GAC9B,iCAAiC,CAenC;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}

package/dist/webauthn/codec.js

@@ -0,0 +1,118 @@
+// conversion between the server's wire format (base64url strings) and the
+// browser webauthn api's format (Uint8Array/ArrayBuffer), plus the
+// serialization of a completed ceremony back into the wire format.
+import { AuthenticationPublicKeyCredentialSchema, RegisterPublicKeyCredentialSchema, } from "./types.js";
+/**
+ * convert a base64url string to a Uint8Array.
+ * handles both standard base64 and base64url encoding.
+ */
+export function base64ToUint8Array(base64) {
+    const standardBase64 = base64.replace(/-/g, "+").replace(/_/g, "/");
+    const binaryString = atob(standardBase64);
+    const bytes = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * convert a Uint8Array to a base64url string (no padding, `-` instead of
+ * `+`, `_` instead of `/`).
+ */
+export function uint8ArrayToBase64(uint8Array) {
+    let binaryString = "";
+    for (let i = 0; i < uint8Array.length; i++) {
+        binaryString += String.fromCharCode(uint8Array[i]);
+    }
+    return btoa(binaryString)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+/** convert an ArrayBuffer to a base64url string. */
+export function arrayBufferToBase64(buffer) {
+    return uint8ArrayToBase64(new Uint8Array(buffer));
+}
+/**
+ * convert the server's registration challenge into browser-compatible
+ * options for `navigator.credentials.create()`, converting base64url
+ * fields to the raw bytes the browser api expects.
+ */
+export function prepareRegistrationOptions(challenge) {
+    const { publicKey } = challenge;
+    return {
+        publicKey: {
+            ...publicKey,
+            challenge: base64ToUint8Array(publicKey.challenge),
+            user: {
+                ...publicKey.user,
+                id: base64ToUint8Array(publicKey.user.id),
+            },
+            excludeCredentials: publicKey.excludeCredentials?.map((cred) => ({
+                ...cred,
+                id: base64ToUint8Array(cred.id),
+            })),
+        },
+    };
+}
+/**
+ * convert the server's authentication challenge into browser-compatible
+ * options for `navigator.credentials.get()`.
+ */
+export function prepareAuthenticationOptions(challenge) {
+    const { publicKey } = challenge;
+    return {
+        publicKey: {
+            ...publicKey,
+            challenge: base64ToUint8Array(publicKey.challenge),
+            allowCredentials: publicKey.allowCredentials?.map((cred) => ({
+                ...cred,
+                id: base64ToUint8Array(cred.id),
+            })),
+        },
+    };
+}
+/**
+ * convert a browser registration credential into the server-compatible
+ * wire format for a `register_finish` call, validating the result against
+ * the schema.
+ */
+export function serializeRegistrationCredential(credential) {
+    const response = credential.response;
+    return RegisterPublicKeyCredentialSchema.parse({
+        id: credential.id,
+        rawId: arrayBufferToBase64(credential.rawId),
+        type: "public-key",
+        response: {
+            attestationObject: arrayBufferToBase64(response.attestationObject),
+            clientDataJSON: arrayBufferToBase64(credential.response.clientDataJSON),
+        },
+    });
+}
+/**
+ * convert a browser authentication assertion into the server-compatible
+ * wire format for a `login_finish` call, validating the result against the
+ * schema.
+ */
+export function serializeAuthenticationCredential(credential) {
+    const response = credential.response;
+    return AuthenticationPublicKeyCredentialSchema.parse({
+        id: credential.id,
+        rawId: arrayBufferToBase64(credential.rawId),
+        type: "public-key",
+        response: {
+            authenticatorData: arrayBufferToBase64(response.authenticatorData),
+            clientDataJSON: arrayBufferToBase64(credential.response.clientDataJSON),
+            signature: arrayBufferToBase64(response.signature),
+            userHandle: response.userHandle
+                ? arrayBufferToBase64(response.userHandle)
+                : undefined,
+        },
+    });
+}
+/** check whether the webauthn create() api is available in this context. */
+export function isWebAuthnAvailable() {
+    return (typeof navigator !== "undefined" &&
+        typeof navigator.credentials !== "undefined" &&
+        typeof navigator.credentials.create === "function");
+}

package/dist/webauthn/codec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=codec.test.d.ts.map

package/dist/webauthn/codec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.test.d.ts","sourceRoot":"","sources":["../../src/webauthn/codec.test.ts"],"names":[],"mappings":""}