@muljax/edge-passkey 1.0.0 → 1.0.2

package/README.md

@@ -5,14 +5,14 @@ Zero-dependency, high-performance WebAuthn and Passkey verification engine desig
 [![Tests](https://img.shields.io/badge/tests-24%20passing-brightgreen)](#)
 [![License: MPL 2.0](https://img.shields.io/badge/License-MPL%202.0-brightgreen.svg)](LICENSE)
 [![Zero Dependencies](https://img.shields.io/badge/dependencies-0-success)](#)
-[![Bundle Size](https://img.shields.io/badge/bundle%20size-%3C3.8%20KB-blue)](#)
+[![Bundle Size](https://img.shields.io/badge/bundle%20size-5.1%20KB%20(gzipped)-blue)](#)
 
 ---
 
 ## Highlights
 
 - **Zero Dependencies:** Pure TypeScript running directly on native Web Cryptography (`crypto.subtle`) and `DataView`.
-- **Ultra Lightweight:** Less than 3.8 KB gzipped. Strips out legacy enterprise attestation bloat (X.509 chains, TPM 2.0, SafetyNet).
+- **Ultra Lightweight:** 5.1 KB minified + gzipped. Strips out legacy enterprise attestation bloat (X.509 chains, TPM 2.0, SafetyNet).
 - **Sub-Millisecond Verification:** Verified in $< 0.8\text{ ms}$ on V8 isolates and Cloudflare Workers.
 - **Modern Passkey Profile:** Native support for Apple iCloud Keychain, Google Password Manager, Windows Hello, 1Password, Bitwarden, and YubiKeys.
 - **Cryptographic Suite:** Hardware-verified ES256 (P-256), EdDSA (Ed25519), RS256, PS256, ES384, and ES512.

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@muljax/edge-passkey",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Zero-dependency, high-performance WebAuthn / Passkey verification engine for edge runtimes (Cloudflare Workers, Bun, Deno, Node)",
   "repository": {
     "type": "git",
-    "url": "https://github.com/muljax/edge-passkey.git"
+    "url": "git+https://github.com/Muljax/edge-passkey.git"
   },
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/binary/base64url.d.ts

@@ -1,12 +0,0 @@
-/**
- * Decodes a Base64URL string into a Uint8Array.
- */
-export declare function base64URLToBytes(base64url: string): Uint8Array;
-/**
- * Encodes a Uint8Array into an unpadded Base64URL string.
- */
-export declare function bytesToBase64URL(bytes: Uint8Array): string;
-/**
- * Performs a constant-time byte equality check to prevent timing side-channels.
- */
-export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/binary/cbor.d.ts

@@ -1,12 +0,0 @@
-export type CBORValue = number | bigint | string | boolean | null | undefined | Uint8Array | CBORValue[] | Map<number | string, CBORValue>;
-/**
- * Decodes a CBOR buffer into its corresponding JavaScript value.
- */
-export declare function decodeCBOR(buffer: Uint8Array): CBORValue;
-/**
- * Decodes a CBOR item and returns the decoded value along with the exact raw byte slice consumed.
- */
-export declare function decodeCBORWithSlice(buffer: Uint8Array): {
-    value: CBORValue;
-    rawSlice: Uint8Array;
-};

package/dist/binary/index.d.ts

@@ -1,3 +0,0 @@
-export * from "./base64url";
-export * from "./reader";
-export * from "./cbor";

package/dist/binary/reader.d.ts

@@ -1,19 +0,0 @@
-/**
- * Bounds-checked sequential binary reader over an underlying DataView.
- */
-export declare class BinaryReader {
-    private readonly buffer;
-    private readonly view;
-    private offset;
-    constructor(buffer: Uint8Array);
-    get cursor(): number;
-    get remaining(): number;
-    hasBytes(count: number): boolean;
-    readUint8(): number;
-    readUint16(): number;
-    readUint32(): number;
-    readBigUint64(): bigint;
-    readBytes(length: number): Uint8Array;
-    seek(offset: number): void;
-    private assertAvailable;
-}

package/dist/core/authentication.d.ts

@@ -1,5 +0,0 @@
-import type { AuthenticationVerificationOptions, AuthenticationResult } from "@/types";
-/**
- * Verifies a WebAuthn authentication assertion response.
- */
-export declare function verifyAuthentication(options: AuthenticationVerificationOptions): Promise<AuthenticationResult>;

package/dist/core/index.d.ts

@@ -1,2 +0,0 @@
-export * from "./registration";
-export * from "./authentication";

package/dist/core/registration.d.ts

@@ -1,5 +0,0 @@
-import type { RegistrationVerificationOptions, RegistrationResult } from "@/types";
-/**
- * Verifies a WebAuthn registration response.
- */
-export declare function verifyRegistration(options: RegistrationVerificationOptions): Promise<RegistrationResult>;

package/dist/cose/coseParser.d.ts

@@ -1,5 +0,0 @@
-import type { ParsedCOSEKey } from "@/types";
-/**
- * Imports a raw CBOR-encoded COSE Key into a native WebCrypto CryptoKey.
- */
-export declare function importCOSEPublicKey(coseBytes: Uint8Array): Promise<ParsedCOSEKey>;

package/dist/cose/index.d.ts

@@ -1 +0,0 @@
-export * from "./coseParser";

package/dist/errors/index.d.ts

@@ -1,30 +0,0 @@
-export type WebAuthnErrorCode = "CHALLENGE_MISMATCH" | "ORIGIN_MISMATCH" | "RP_ID_MISMATCH" | "USER_PRESENCE_NOT_SET" | "USER_VERIFICATION_FAILED" | "COUNTER_ROLLBACK" | "INVALID_SIGNATURE" | "INVALID_ATTESTATION" | "MALFORMED_PAYLOAD" | "UNSUPPORTED_ALGORITHM" | "KEY_PARSING_FAILED";
-export declare class WebAuthnError extends Error {
-    readonly code: WebAuthnErrorCode;
-    readonly details?: Record<string, unknown>;
-    constructor(code: WebAuthnErrorCode, message: string, details?: Record<string, unknown>);
-}
-export declare class ChallengeMismatchError extends WebAuthnError {
-    constructor(expected: string, received: string);
-}
-export declare class OriginMismatchError extends WebAuthnError {
-    constructor(expected: string | string[], received: string);
-}
-export declare class RpIdMismatchError extends WebAuthnError {
-    constructor(expectedRpId: string);
-}
-export declare class UserPresenceError extends WebAuthnError {
-    constructor();
-}
-export declare class UserVerificationPolicyError extends WebAuthnError {
-    constructor();
-}
-export declare class CounterRollbackError extends WebAuthnError {
-    constructor(storedCount: number, receivedCount: number);
-}
-export declare class InvalidSignatureError extends WebAuthnError {
-    constructor(message?: string);
-}
-export declare class MalformedPayloadError extends WebAuthnError {
-    constructor(message: string, details?: Record<string, unknown>);
-}

package/dist/helpers/index.d.ts

@@ -1 +0,0 @@
-export * from "./options";

package/dist/helpers/options.d.ts

@@ -1,80 +0,0 @@
-import { COSEAlgorithm } from "@/types";
-export interface GenerateRegistrationOptionsArgs {
-    rpName: string;
-    rpId: string;
-    userName: string;
-    userID?: Uint8Array | string;
-    userDisplayName?: string;
-    challenge?: Uint8Array | string;
-    supportedAlgorithms?: COSEAlgorithm[];
-    attestationType?: "none" | "direct" | "enterprise";
-    residentKey?: "preferred" | "required" | "discouraged";
-    userVerification?: "preferred" | "required" | "discouraged";
-    authenticatorAttachment?: "platform" | "cross-platform";
-    timeout?: number;
-    excludeCredentials?: Array<{
-        id: Uint8Array | string;
-        transports?: AuthenticatorTransport[];
-    }>;
-    extensions?: Record<string, unknown>;
-}
-export interface PublicKeyCredentialCreationOptionsJSON {
-    challenge: string;
-    rp: {
-        name: string;
-        id: string;
-    };
-    user: {
-        id: string;
-        name: string;
-        displayName: string;
-    };
-    pubKeyCredParams: Array<{
-        type: "public-key";
-        alg: COSEAlgorithm;
-    }>;
-    timeout: number;
-    attestation: "none" | "direct" | "enterprise";
-    authenticatorSelection: {
-        residentKey?: "preferred" | "required" | "discouraged";
-        userVerification?: "preferred" | "required" | "discouraged";
-        authenticatorAttachment?: "platform" | "cross-platform";
-    };
-    excludeCredentials?: Array<{
-        id: string;
-        type: "public-key";
-        transports?: AuthenticatorTransport[];
-    }>;
-    extensions?: Record<string, unknown>;
-}
-/**
- * Generates RFC-compliant PublicKeyCredentialCreationOptions for navigator.credentials.create().
- */
-export declare function generateRegistrationOptions(args: GenerateRegistrationOptionsArgs): PublicKeyCredentialCreationOptionsJSON;
-export interface GenerateAuthenticationOptionsArgs {
-    rpId: string;
-    challenge?: Uint8Array | string;
-    timeout?: number;
-    userVerification?: "preferred" | "required" | "discouraged";
-    allowCredentials?: Array<{
-        id: Uint8Array | string;
-        transports?: AuthenticatorTransport[];
-    }>;
-    extensions?: Record<string, unknown>;
-}
-export interface PublicKeyCredentialRequestOptionsJSON {
-    challenge: string;
-    rpId: string;
-    timeout: number;
-    userVerification: "preferred" | "required" | "discouraged";
-    allowCredentials?: Array<{
-        id: string;
-        type: "public-key";
-        transports?: AuthenticatorTransport[];
-    }>;
-    extensions?: Record<string, unknown>;
-}
-/**
- * Generates RFC-compliant PublicKeyCredentialRequestOptions for navigator.credentials.get().
- */
-export declare function generateAuthenticationOptions(args: GenerateAuthenticationOptionsArgs): PublicKeyCredentialRequestOptionsJSON;

package/dist/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./types";
-export * from "./binary";
-export * from "./cose";
-export * from "./protocol";
-export * from "./core";
-export * from "./errors";
-export * from "./helpers";

package/dist/protocol/authData.d.ts

@@ -1,9 +0,0 @@
-import type { ParsedAuthData } from "@/types";
-/**
- * Parses raw binary authenticatorData, unpacking flags, counters, and credential structures.
- */
-export declare function parseAuthenticatorData(authDataBytes: Uint8Array): ParsedAuthData;
-/**
- * Formats a 16-byte AAGUID into a canonical UUID string (8-4-4-4-12).
- */
-export declare function formatAAGUID(aaguid: Uint8Array): string;

package/dist/protocol/clientData.d.ts

@@ -1,5 +0,0 @@
-import type { ParsedClientData } from "@/types";
-/**
- * Validates the clientDataJSON string and computes its SHA-256 hash.
- */
-export declare function parseAndVerifyClientData(clientDataInput: string | Uint8Array, expectedType: "webauthn.create" | "webauthn.get"): Promise<ParsedClientData>;

package/dist/protocol/der.d.ts

@@ -1,4 +0,0 @@
-/**
- * Normalizes an ASN.1 DER ECDSA signature into a fixed-length IEEE P1363 (r || s) byte array.
- */
-export declare function derToIEEEP1363(derSignature: Uint8Array, keyCoordinateLength?: number): Uint8Array;

package/dist/protocol/extensions.d.ts

@@ -1,29 +0,0 @@
-import { CBORValue } from "@/binary";
-export interface CredentialPropertiesExtension {
-    rk?: boolean;
-}
-export interface PRFExtensionResults {
-    first?: Uint8Array;
-    second?: Uint8Array;
-}
-export interface ParsedExtensions {
-    credProps?: CredentialPropertiesExtension;
-    prf?: {
-        enabled?: boolean;
-        results?: PRFExtensionResults;
-    };
-    largeBlob?: {
-        supported?: boolean;
-        blob?: Uint8Array;
-        written?: boolean;
-    };
-    appId?: boolean;
-    raw?: Map<string | number, CBORValue>;
-}
-/**
- * Parses trailing CBOR extension map from authenticatorData when the ED flag is present.
- */
-export declare function parseAuthenticatorExtensions(extensionBytes: Uint8Array): {
-    extensions: ParsedExtensions;
-    bytesConsumed: number;
-};

package/dist/protocol/index.d.ts

@@ -1,5 +0,0 @@
-export * from "./authData";
-export * from "./clientData";
-export * from "./der";
-export * from "./origin";
-export * from "./extensions";

package/dist/protocol/origin.d.ts

@@ -1,5 +0,0 @@
-export type ExpectedOrigin = string | string[] | ((origin: string) => boolean | Promise<boolean>);
-/**
- * Validates the clientData origin against allowed origins, wildcards, or mobile app facet identifiers.
- */
-export declare function verifyOrigin(receivedOrigin: string, expectedOrigin: ExpectedOrigin, allowCrossOrigin?: boolean, crossOriginFlag?: boolean): Promise<void>;

package/dist/types/cose.d.ts

@@ -1,30 +0,0 @@
-/**
- * Supported COSE algorithm identifiers.
- */
-export declare enum COSEAlgorithm {
-    ES256 = -7,
-    EdDSA = -8,
-    ES384 = -35,
-    ES512 = -36,
-    RS256 = -257,
-    RS384 = -258,
-    RS512 = -259,
-    PS256 = -37
-}
-/**
- * Supported COSE key types.
- */
-export declare enum COSEKeyType {
-    OKP = 1,
-    EC2 = 2,
-    RSA = 3
-}
-/**
- * Supported COSE elliptic curves.
- */
-export declare enum COSECurve {
-    P256 = 1,
-    P384 = 2,
-    P521 = 3,
-    Ed25519 = 6
-}

package/dist/types/flags.d.ts

@@ -1,12 +0,0 @@
-/**
- * Bitfield flags parsed from authenticator data.
- */
-export interface AuthenticatorFlags {
-    up: boolean;
-    uv: boolean;
-    be: boolean;
-    bs: boolean;
-    at: boolean;
-    ed: boolean;
-    raw: number;
-}

package/dist/types/index.d.ts

@@ -1,3 +0,0 @@
-export * from "./cose";
-export * from "./flags";
-export * from "./models";

package/dist/types/models.d.ts

@@ -1,103 +0,0 @@
-import type { AuthenticatorFlags } from "./flags";
-import type { COSEAlgorithm, COSEKeyType } from "./cose";
-import type { ParsedExtensions } from "@/protocol/extensions";
-import type { ExpectedOrigin } from "@/protocol/origin";
-/**
- * Parsed binary authenticator data structure.
- */
-export interface ParsedAuthData {
-    rpIdHash: Uint8Array;
-    flags: AuthenticatorFlags;
-    signCount: number;
-    aaguid?: Uint8Array;
-    credentialId?: Uint8Array;
-    credentialPublicKey?: Uint8Array;
-    extensions?: ParsedExtensions;
-    raw: Uint8Array;
-}
-/**
- * Parsed and validated clientDataJSON payload.
- */
-export interface ParsedClientData {
-    type: string;
-    challenge: string;
-    origin: string;
-    crossOrigin?: boolean;
-    rawJson: string;
-    sha256: Uint8Array;
-}
-/**
- * Imported WebCrypto public key with associated COSE metadata.
- */
-export interface ParsedCOSEKey {
-    kty: COSEKeyType;
-    alg: COSEAlgorithm;
-    cryptoKey: CryptoKey;
-    algorithmParams: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams;
-}
-/**
- * Input parameters for verifying a WebAuthn registration response.
- */
-export interface RegistrationVerificationOptions {
-    response: {
-        id: string;
-        rawId: string;
-        response: {
-            clientDataJSON: string | Uint8Array;
-            attestationObject: string | Uint8Array;
-        };
-    };
-    expectedChallenge: string;
-    expectedOrigin: ExpectedOrigin;
-    expectedRpId: string;
-    requireUserVerification?: boolean;
-    allowCrossOrigin?: boolean;
-}
-/**
- * Verification outcome containing the newly enrolled credential.
- */
-export interface RegistrationResult {
-    verified: boolean;
-    credential: {
-        id: string;
-        publicKey: Uint8Array;
-        aaguid: string;
-        signCount: number;
-        backupEligible: boolean;
-        backupState: boolean;
-    };
-    extensions?: ParsedExtensions;
-}
-/**
- * Input parameters for verifying a WebAuthn authentication assertion response.
- */
-export interface AuthenticationVerificationOptions {
-    response: {
-        id: string;
-        rawId: string;
-        response: {
-            clientDataJSON: string | Uint8Array;
-            authenticatorData: string | Uint8Array;
-            signature: string | Uint8Array;
-            userHandle?: string;
-        };
-    };
-    expectedChallenge: string;
-    expectedOrigin: ExpectedOrigin;
-    expectedRpId: string;
-    credentialPublicKey: Uint8Array;
-    prevSignCount?: number;
-    requireUserVerification?: boolean;
-    allowCrossOrigin?: boolean;
-}
-/**
- * Verification outcome of an authentication assertion.
- */
-export interface AuthenticationResult {
-    verified: boolean;
-    newSignCount: number;
-    userPresent: boolean;
-    userVerified: boolean;
-    backupState: boolean;
-    extensions?: ParsedExtensions;
-}