@muljax/edge-passkey 1.0.0

package/LICENSE

@@ -0,0 +1,297 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or entity that creates, contributes to the
+    creation of, or owns Existing Contributor Charge in a Modification.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code Form,
+    and Modifications of such Source Code Form, in each case including portions
+    thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in a separate
+    file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible, whether
+    at the time of the initial grant or subsequently, any and all of the
+    rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+    (a) any addition to or deletion from the contents of a file containing
+        Covered Software; or
+
+    (b) any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method, process,
+    and apparatus claims, in any patent Licensable by such Contributor that
+    would be infringed, but for the grant of the License, by the making,
+    using, selling, offering for sale, having made, import, or transfer of
+    either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU Lesser
+    General Public License, Version 2.1, the GNU Affero General Public
+    License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that controls, is
+    controlled by, or is under common control with You. For purposes of this
+    definition, "control" means (a) the power, direct or indirect, to cause
+    the direction or management of such entity, whether by contract or
+    otherwise, or (b) ownership of more than fifty percent (50%) of the
+    outstanding shares or beneficial ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive
+license:
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or as
+    part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer for
+    sale, have made, import, and otherwise transfer either its Contributions
+    or its Contributor Version.
+
+2.2. Effective Date
+The licenses granted in Section 2.1 with respect to any Contribution become
+effective for each Contribution on the date the Contributor first distributes
+such Contribution.
+
+2.3. Limitations on Grant Scope
+The licenses granted in this Section 2 are the only rights granted under this
+License. No additional terms or conditions will be implied. No other
+intellectual property rights are granted under this License.
+
+2.4. Subsequent Licenses
+No Contributor makes additional grants as a result of You distributing the
+Covered Software under a subsequent version of this License (see Section 10.2)
+or under the terms of a Secondary License (if permitted under the terms of
+Section 3.3).
+
+2.5. Representation
+Each Contributor represents that the Contributor believes its Contributions
+are its original creation(s) or it has sufficient rights to grant the
+rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+This License is not intended to limit any rights You have under applicable
+copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Availability of Source Code
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under the
+terms of this License. You must inform recipients that the Source Code Form of
+the Covered Software is governed by the terms of this License, and how they
+can obtain a copy of this License. You must make the Source Code Form of any
+such Modifications publicly available under the terms of this License.
+
+3.2. Distribution of Executable Form
+If You distribute Covered Software in Executable Form then:
+(a) such Covered Software must also be made available in Source Code Form, as
+    described in Section 3.1, and You must inform recipients of the Executable
+    Form how they can obtain a copy of such Source Code Form by reasonable
+    means in a timely manner, at a charge no more than the cost of distribution
+    to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this License,
+    or sublicense it under different terms, provided that the license for the
+    Executable Form does not attempt to limit or alter the recipients' rights
+    in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for the
+Covered Software. If the Larger Work is a combination of Covered Software with
+a work governed by one or more Secondary Licenses, and the Covered Software is
+not Incompatible With Secondary Licenses, this License permits You to
+additionally distribute such Covered Software under the terms of such Secondary
+License(s), so that the recipient of the Larger Work may, at their option,
+further distribute the Covered Software under the terms of either this License
+or such Secondary License(s).
+
+3.4. Notices
+You may not remove or alter the substance of any license notices (including
+copyright notices, patent notices, disclaimers of warranty, or limitations of
+liability) contained within the Source Code Form of the Covered Software,
+except that You may alter any notices to the extent required to remedy known
+factual inaccuracies.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this License
+with respect to some or all of the Covered Software due to statute, judicial
+order, or regulation then You must: (a) comply with the terms of this License
+to the maximum extent possible; and (b) describe the limitations and the code
+they affect. Such description must be placed in a text file included with all
+distributions of the Covered Software. Except to the extent prohibited by
+statute or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically if You
+fail to comply with any of its terms. However, if You become compliant, then the
+rights granted under this License from a particular Contributor are reinstated
+(a) provisionally, unless and until such Contributor explicitly and finally
+terminates Your grants, and (b) on an ongoing basis, if such Contributor fails
+to notify You of the non-compliance by some reasonable means prior to 60 days
+after You have come back into compliance. Moreover, Your grants from a
+particular Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the first
+time You have received notice of non-compliance with this License from such
+Contributor, and You become compliant prior to 30 days after Your receipt of the
+notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions, counter-claims, and
+cross-claims) alleging that a Contributor Version directly or indirectly
+infringes any patent, then the rights granted to You by any and all
+Contributors for the Covered Software under Section 2.1 of this License shall
+terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+license agreements (excluding distributors and resellers) which have been
+validly granted by You or Your distributors under this License prior to
+termination shall survive termination.
+
+6. Disclaimer of Warranty
+-------------------------
+
+Covered Software is provided under this License on an "as is" basis, without
+warranty of any kind, either expressed, implied, or statutory, including,
+without limitation, warranties that the Covered Software is free of defects,
+merchantable, fit for a particular purpose or non-infringing. The entire
+risk as to the quality and performance of the Covered Software is with You.
+Should any Covered Software prove defective in any respect, You (not any
+Contributor) assume the cost of any necessary servicing, repair, or
+correction. This disclaimer of warranty constitutes an essential part of this
+License. No use of any Covered Software is authorized under this License
+except under this disclaimer.
+
+7. Limitation of Liability
+--------------------------
+
+Under no circumstances and under no legal theory, whether tort (including
+negligence), contract, or otherwise, shall any Contributor, or anyone who
+distributes Covered Software as permitted above, be liable to You for any
+direct, indirect, special, incidental, or exemplary damages of any character
+including, without limitation, damages for lost profits, loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all other commercial
+damages or losses, even if such party shall have been informed of the
+possibility of such damages. This limitation of liability shall not apply to
+liability for death or personal injury resulting from such party's negligence to
+the extent applicable law prohibits such limitation. Some jurisdictions do not
+allow the exclusion or limitation of incidental or exemplary damages, so this
+exclusion and limitation may not apply to You.
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the courts of a
+jurisdiction where the defendant maintains its principal place of business and
+such litigation shall be governed by laws of that jurisdiction, without
+reference to its conflict-of-law provisions. Nothing in this Section shall
+prevent a party's ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject matter
+hereof. If any provision of this License is held to be unenforceable, such
+provision shall be reformed only to the extent necessary to make it
+enforceable. Any law or regulation which provides that the language of a
+contract shall be construed against the drafter shall not be used to construe
+this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+Mozilla Foundation is the license steward. Except as provided in Section 10.3,
+no one other than the license steward has the right to modify or publish new
+versions of this License. Each version will be given a distinguishing version
+number.
+
+10.2. Effect of New Versions
+You may distribute the Covered Software under the terms of the version of the
+License under which You originally received the Covered Software, or under the
+terms of any subsequent version published by the license steward.
+
+10.3. Modified Versions
+If you create software not governed by this License, and you want to create a
+new license for such software, you may create and use a modified version of
+this License if you rename the license and remove any references to the name of
+the license steward (except to note that such modified license differs from
+this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+If You choose to distribute Source Code Form that is Incompatible With Secondary
+Licenses under the terms of this version of the License, the notice described
+in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible to put the notice in a particular Source Code Form
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+This Source Code Form is "Incompatible With Secondary Licenses", as
+defined by the Mozilla Public License, v. 2.0.

package/README.md

@@ -0,0 +1,154 @@
+# @muljax/edge-passkey
+
+Zero-dependency, high-performance WebAuthn and Passkey verification engine designed specifically for edge runtimes (Cloudflare Workers, Bun, Deno, V8 Isolates, and Node.js).
+
+[![Tests](https://img.shields.io/badge/tests-24%20passing-brightgreen)](#)
+[![License: MPL 2.0](https://img.shields.io/badge/License-MPL%202.0-brightgreen.svg)](LICENSE)
+[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-success)](#)
+[![Bundle Size](https://img.shields.io/badge/bundle%20size-%3C3.8%20KB-blue)](#)
+
+---
+
+## Highlights
+
+- **Zero Dependencies:** Pure TypeScript running directly on native Web Cryptography (`crypto.subtle`) and `DataView`.
+- **Ultra Lightweight:** Less than 3.8 KB gzipped. Strips out legacy enterprise attestation bloat (X.509 chains, TPM 2.0, SafetyNet).
+- **Sub-Millisecond Verification:** Verified in $< 0.8\text{ ms}$ on V8 isolates and Cloudflare Workers.
+- **Modern Passkey Profile:** Native support for Apple iCloud Keychain, Google Password Manager, Windows Hello, 1Password, Bitwarden, and YubiKeys.
+- **Cryptographic Suite:** Hardware-verified ES256 (P-256), EdDSA (Ed25519), RS256, PS256, ES384, and ES512.
+- **Extensions & PRF:** Built-in parsing for `credProps` (discoverable credentials) and `prf` (hardware-derived E2EE keys).
+
+---
+
+## Installation
+
+```bash
+# Bun
+bun add @muljax/edge-passkey
+
+# npm
+npm install @muljax/edge-passkey
+
+# pnpm
+pnpm add @muljax/edge-passkey
+```
+
+---
+
+## Quickstart
+
+### 1. Registration Ceremony
+
+```typescript
+import {
+  generateRegistrationOptions,
+  verifyRegistration,
+  WebAuthnError,
+} from "@muljax/edge-passkey";
+
+// Step A: Generate Registration Options
+const options = generateRegistrationOptions({
+  rpName: "Acme Corp",
+  rpId: "auth.example.com",
+  userName: "alex@example.com",
+  residentKey: "preferred",
+  userVerification: "preferred",
+});
+
+// Store `options.challenge` in session/cache (TTL: 2 min)
+
+// Step B: Verify Registration Response from Browser
+try {
+  const result = await verifyRegistration({
+    response: clientRegistrationPayload,
+    expectedChallenge: storedChallenge,
+    expectedOrigin: "https://auth.example.com",
+    expectedRpId: "auth.example.com",
+  });
+
+  console.log("Enrolled credential:", result.credential.id);
+} catch (err) {
+  if (err instanceof WebAuthnError) {
+    console.error("WebAuthn verification error:", err.code, err.message);
+  }
+}
+```
+
+---
+
+### 2. Authentication Ceremony
+
+```typescript
+import {
+  generateAuthenticationOptions,
+  verifyAuthentication,
+  WebAuthnError,
+} from "@muljax/edge-passkey";
+
+// Step A: Generate Authentication Options
+const options = generateAuthenticationOptions({
+  rpId: "auth.example.com",
+  allowCredentials: [{ id: storedCredentialId }],
+});
+
+// Store `options.challenge` in session/cache (TTL: 2 min)
+
+// Step B: Verify Assertion Response from Browser
+try {
+  const result = await verifyAuthentication({
+    response: clientAuthenticationPayload,
+    expectedChallenge: storedChallenge,
+    expectedOrigin: "https://auth.example.com",
+    expectedRpId: "auth.example.com",
+    credentialPublicKey: storedPublicKey,
+    prevSignCount: storedSignCount,
+  });
+
+  console.log("Authenticated! User present:", result.userPresent);
+} catch (err) {
+  if (err instanceof WebAuthnError) {
+    console.error("Authentication failed:", err.code, err.message);
+  }
+}
+```
+
+---
+
+## Error Handling
+
+`@muljax/edge-passkey` provides typed error classes inheriting from `WebAuthnError`:
+
+```typescript
+import {
+  WebAuthnError,
+  ChallengeMismatchError,
+  OriginMismatchError,
+  RpIdMismatchError,
+  CounterRollbackError,
+  UserPresenceError,
+  UserVerificationPolicyError,
+  InvalidSignatureError,
+  MalformedPayloadError,
+} from "@muljax/edge-passkey";
+```
+
+---
+
+## Development & Testing
+
+```bash
+# Run unit & integration tests
+bun test
+
+# Run interactive testing server & UI
+bun run dev
+```
+
+## License
+
+This project is licensed under the **Mozilla Public License 2.0 (MPL-2.0)** - see the [LICENSE](LICENSE) file for details.
+
+- **Derivative Works & Larger Works:** You may use and integrate this library into proprietary and commercial applications.
+- **Modifications to Covered Files:** Any modifications made directly to this library's source files must be made publicly available under the MPL-2.0.
+- **Attribution:** All distributions and derivative works must preserve original copyright and license notices.
+

package/dist/binary/base64url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Decodes a Base64URL string into a Uint8Array.
+ */
+export declare function base64URLToBytes(base64url: string): Uint8Array;
+/**
+ * Encodes a Uint8Array into an unpadded Base64URL string.
+ */
+export declare function bytesToBase64URL(bytes: Uint8Array): string;
+/**
+ * Performs a constant-time byte equality check to prevent timing side-channels.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/binary/cbor.d.ts

@@ -0,0 +1,12 @@
+export type CBORValue = number | bigint | string | boolean | null | undefined | Uint8Array | CBORValue[] | Map<number | string, CBORValue>;
+/**
+ * Decodes a CBOR buffer into its corresponding JavaScript value.
+ */
+export declare function decodeCBOR(buffer: Uint8Array): CBORValue;
+/**
+ * Decodes a CBOR item and returns the decoded value along with the exact raw byte slice consumed.
+ */
+export declare function decodeCBORWithSlice(buffer: Uint8Array): {
+    value: CBORValue;
+    rawSlice: Uint8Array;
+};

package/dist/binary/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./base64url";
+export * from "./reader";
+export * from "./cbor";

package/dist/binary/reader.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Bounds-checked sequential binary reader over an underlying DataView.
+ */
+export declare class BinaryReader {
+    private readonly buffer;
+    private readonly view;
+    private offset;
+    constructor(buffer: Uint8Array);
+    get cursor(): number;
+    get remaining(): number;
+    hasBytes(count: number): boolean;
+    readUint8(): number;
+    readUint16(): number;
+    readUint32(): number;
+    readBigUint64(): bigint;
+    readBytes(length: number): Uint8Array;
+    seek(offset: number): void;
+    private assertAvailable;
+}

package/dist/core/authentication.d.ts

@@ -0,0 +1,5 @@
+import type { AuthenticationVerificationOptions, AuthenticationResult } from "@/types";
+/**
+ * Verifies a WebAuthn authentication assertion response.
+ */
+export declare function verifyAuthentication(options: AuthenticationVerificationOptions): Promise<AuthenticationResult>;

package/dist/core/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./registration";
+export * from "./authentication";

package/dist/core/registration.d.ts

@@ -0,0 +1,5 @@
+import type { RegistrationVerificationOptions, RegistrationResult } from "@/types";
+/**
+ * Verifies a WebAuthn registration response.
+ */
+export declare function verifyRegistration(options: RegistrationVerificationOptions): Promise<RegistrationResult>;

package/dist/cose/coseParser.d.ts

@@ -0,0 +1,5 @@
+import type { ParsedCOSEKey } from "@/types";
+/**
+ * Imports a raw CBOR-encoded COSE Key into a native WebCrypto CryptoKey.
+ */
+export declare function importCOSEPublicKey(coseBytes: Uint8Array): Promise<ParsedCOSEKey>;

package/dist/cose/index.d.ts

@@ -0,0 +1 @@
+export * from "./coseParser";

package/dist/errors/index.d.ts

@@ -0,0 +1,30 @@
+export type WebAuthnErrorCode = "CHALLENGE_MISMATCH" | "ORIGIN_MISMATCH" | "RP_ID_MISMATCH" | "USER_PRESENCE_NOT_SET" | "USER_VERIFICATION_FAILED" | "COUNTER_ROLLBACK" | "INVALID_SIGNATURE" | "INVALID_ATTESTATION" | "MALFORMED_PAYLOAD" | "UNSUPPORTED_ALGORITHM" | "KEY_PARSING_FAILED";
+export declare class WebAuthnError extends Error {
+    readonly code: WebAuthnErrorCode;
+    readonly details?: Record<string, unknown>;
+    constructor(code: WebAuthnErrorCode, message: string, details?: Record<string, unknown>);
+}
+export declare class ChallengeMismatchError extends WebAuthnError {
+    constructor(expected: string, received: string);
+}
+export declare class OriginMismatchError extends WebAuthnError {
+    constructor(expected: string | string[], received: string);
+}
+export declare class RpIdMismatchError extends WebAuthnError {
+    constructor(expectedRpId: string);
+}
+export declare class UserPresenceError extends WebAuthnError {
+    constructor();
+}
+export declare class UserVerificationPolicyError extends WebAuthnError {
+    constructor();
+}
+export declare class CounterRollbackError extends WebAuthnError {
+    constructor(storedCount: number, receivedCount: number);
+}
+export declare class InvalidSignatureError extends WebAuthnError {
+    constructor(message?: string);
+}
+export declare class MalformedPayloadError extends WebAuthnError {
+    constructor(message: string, details?: Record<string, unknown>);
+}

package/dist/helpers/index.d.ts

@@ -0,0 +1 @@
+export * from "./options";

package/dist/helpers/options.d.ts

@@ -0,0 +1,80 @@
+import { COSEAlgorithm } from "@/types";
+export interface GenerateRegistrationOptionsArgs {
+    rpName: string;
+    rpId: string;
+    userName: string;
+    userID?: Uint8Array | string;
+    userDisplayName?: string;
+    challenge?: Uint8Array | string;
+    supportedAlgorithms?: COSEAlgorithm[];
+    attestationType?: "none" | "direct" | "enterprise";
+    residentKey?: "preferred" | "required" | "discouraged";
+    userVerification?: "preferred" | "required" | "discouraged";
+    authenticatorAttachment?: "platform" | "cross-platform";
+    timeout?: number;
+    excludeCredentials?: Array<{
+        id: Uint8Array | string;
+        transports?: AuthenticatorTransport[];
+    }>;
+    extensions?: Record<string, unknown>;
+}
+export interface PublicKeyCredentialCreationOptionsJSON {
+    challenge: string;
+    rp: {
+        name: string;
+        id: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    pubKeyCredParams: Array<{
+        type: "public-key";
+        alg: COSEAlgorithm;
+    }>;
+    timeout: number;
+    attestation: "none" | "direct" | "enterprise";
+    authenticatorSelection: {
+        residentKey?: "preferred" | "required" | "discouraged";
+        userVerification?: "preferred" | "required" | "discouraged";
+        authenticatorAttachment?: "platform" | "cross-platform";
+    };
+    excludeCredentials?: Array<{
+        id: string;
+        type: "public-key";
+        transports?: AuthenticatorTransport[];
+    }>;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Generates RFC-compliant PublicKeyCredentialCreationOptions for navigator.credentials.create().
+ */
+export declare function generateRegistrationOptions(args: GenerateRegistrationOptionsArgs): PublicKeyCredentialCreationOptionsJSON;
+export interface GenerateAuthenticationOptionsArgs {
+    rpId: string;
+    challenge?: Uint8Array | string;
+    timeout?: number;
+    userVerification?: "preferred" | "required" | "discouraged";
+    allowCredentials?: Array<{
+        id: Uint8Array | string;
+        transports?: AuthenticatorTransport[];
+    }>;
+    extensions?: Record<string, unknown>;
+}
+export interface PublicKeyCredentialRequestOptionsJSON {
+    challenge: string;
+    rpId: string;
+    timeout: number;
+    userVerification: "preferred" | "required" | "discouraged";
+    allowCredentials?: Array<{
+        id: string;
+        type: "public-key";
+        transports?: AuthenticatorTransport[];
+    }>;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Generates RFC-compliant PublicKeyCredentialRequestOptions for navigator.credentials.get().
+ */
+export declare function generateAuthenticationOptions(args: GenerateAuthenticationOptionsArgs): PublicKeyCredentialRequestOptionsJSON;

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./types";
+export * from "./binary";
+export * from "./cose";
+export * from "./protocol";
+export * from "./core";
+export * from "./errors";
+export * from "./helpers";

package/dist/index.js

@@ -0,0 +1 @@
+var COSEAlgorithm;((COSEAlgorithm)=>{COSEAlgorithm[COSEAlgorithm["ES256"]=-7]="ES256";COSEAlgorithm[COSEAlgorithm["EdDSA"]=-8]="EdDSA";COSEAlgorithm[COSEAlgorithm["ES384"]=-35]="ES384";COSEAlgorithm[COSEAlgorithm["ES512"]=-36]="ES512";COSEAlgorithm[COSEAlgorithm["RS256"]=-257]="RS256";COSEAlgorithm[COSEAlgorithm["RS384"]=-258]="RS384";COSEAlgorithm[COSEAlgorithm["RS512"]=-259]="RS512";COSEAlgorithm[COSEAlgorithm["PS256"]=-37]="PS256"})(COSEAlgorithm||={});var COSEKeyType;((COSEKeyType)=>{COSEKeyType[COSEKeyType["OKP"]=1]="OKP";COSEKeyType[COSEKeyType["EC2"]=2]="EC2";COSEKeyType[COSEKeyType["RSA"]=3]="RSA"})(COSEKeyType||={});var COSECurve;((COSECurve)=>{COSECurve[COSECurve["P256"]=1]="P256";COSECurve[COSECurve["P384"]=2]="P384";COSECurve[COSECurve["P521"]=3]="P521";COSECurve[COSECurve["Ed25519"]=6]="Ed25519"})(COSECurve||={});function base64URLToBytes(base64url){let base64=base64url.replace(/-/g,"+").replace(/_/g,"/");while(base64.length%4!==0){base64+="="}const binaryString=atob(base64);const len=binaryString.length;const bytes=new Uint8Array(len);for(let i=0;i<len;i++){bytes[i]=binaryString.charCodeAt(i)}return bytes}function bytesToBase64URL(bytes){let binary="";const len=bytes.byteLength;for(let i=0;i<len;i++){binary+=String.fromCharCode(bytes[i])}return btoa(binary).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function timingSafeEqual(a,b){if(a.length!==b.length)return false;let result=0;for(let i=0;i<a.length;i++){result|=a[i]^b[i]}return result===0}class BinaryReader{buffer;view;offset=0;constructor(buffer){this.buffer=buffer;this.view=new DataView(buffer.buffer,buffer.byteOffset,buffer.byteLength)}get cursor(){return this.offset}get remaining(){return this.buffer.byteLength-this.offset}hasBytes(count){return this.offset+count<=this.buffer.byteLength}readUint8(){this.assertAvailable(1);const val=this.view.getUint8(this.offset);this.offset+=1;return val}readUint16(){this.assertAvailable(2);const val=this.view.getUint16(this.offset,false);this.offset+=2;return val}readUint32(){this.assertAvailable(4);const val=this.view.getUint32(this.offset,false);this.offset+=4;return val}readBigUint64(){this.assertAvailable(8);const val=this.view.getBigUint64(this.offset,false);this.offset+=8;return val}readBytes(length){this.assertAvailable(length);const slice=this.buffer.subarray(this.offset,this.offset+length);this.offset+=length;return slice}seek(offset){if(offset<0||offset>this.buffer.byteLength){throw new RangeError(`Invalid seek offset: ${offset}`)}this.offset=offset}assertAvailable(length){if(this.offset+length>this.buffer.byteLength){throw new RangeError(`Buffer underflow: Attempted to read ${length} bytes at offset ${this.offset} (length: ${this.buffer.byteLength})`)}}}function decodeCBOR(buffer){const reader=new BinaryReader(buffer);return parseCBORItem(reader)}function decodeCBORWithSlice(buffer){const reader=new BinaryReader(buffer);const start=reader.cursor;const value=parseCBORItem(reader);const end=reader.cursor;return{value,rawSlice:buffer.subarray(start,end)}}function parseCBORItem(reader){const initialByte=reader.readUint8();const majorType=initialByte>>5;const additionalInfo=initialByte&31;if(majorType===7){if(additionalInfo===20)return false;if(additionalInfo===21)return true;if(additionalInfo===22)return null;if(additionalInfo===23)return;return additionalInfo}const length=readLength(reader,additionalInfo);switch(majorType){case 0:return length;case 1:return typeof length==="bigint"?-1n-length:-1-Number(length);case 2:return reader.readBytes(Number(length));case 3:{const strBytes=reader.readBytes(Number(length));return new TextDecoder("utf-8").decode(strBytes)}case 4:{const arrLen=Number(length);const arr=new Array(arrLen);for(let i=0;i<arrLen;i++){arr[i]=parseCBORItem(reader)}return arr}case 5:{const mapLen=Number(length);const map=new Map;for(let i=0;i<mapLen;i++){const key=parseCBORItem(reader);if(typeof key!=="number"&&typeof key!=="string"){throw new Error(`Unsupported CBOR map key type: ${typeof key}`)}map.set(key,parseCBORItem(reader))}return map}default:throw new Error(`Unsupported CBOR Major Type: ${majorType}`)}}function readLength(reader,additionalInfo){if(additionalInfo<24)return additionalInfo;if(additionalInfo===24)return reader.readUint8();if(additionalInfo===25)return reader.readUint16();if(additionalInfo===26)return reader.readUint32();if(additionalInfo===27)return reader.readBigUint64();throw new Error(`Unsupported CBOR length info: ${additionalInfo}`)}async function importCOSEPublicKey(coseBytes){const map=decodeCBOR(coseBytes);if(!(map instanceof Map)){throw new Error("Invalid COSE Key: Root structure must be a CBOR Map")}const kty=map.get(1);const alg=map.get(3);if(!kty||!alg){throw new Error("Invalid COSE Key: Missing required kty (1) or alg (3) parameters")}if(kty===2){const crv=map.get(-1);const x=map.get(-2);const y=map.get(-3);if(!x||!y||!(x instanceof Uint8Array)||!(y instanceof Uint8Array)){throw new Error("Invalid COSE EC2 Key: Missing or invalid x/y coordinate bytes")}let namedCurve;let hashName;if(crv===1&&alg===-7){namedCurve="P-256";hashName="SHA-256"}else if(crv===2&&alg===-35){namedCurve="P-384";hashName="SHA-384"}else if(crv===3&&alg===-36){namedCurve="P-521";hashName="SHA-512"}else{throw new Error(`Unsupported EC2 Curve (${crv}) or Algorithm (${alg})`)}const rawPoint=new Uint8Array(1+x.length+y.length);rawPoint[0]=4;rawPoint.set(x,1);rawPoint.set(y,1+x.length);const algorithmParams={name:"ECDSA",namedCurve};const cryptoKey=await crypto.subtle.importKey("raw",rawPoint,algorithmParams,true,["verify"]);return{kty,alg,cryptoKey,algorithmParams:{...algorithmParams,hash:{name:hashName}}}}if(kty===1){const crv=map.get(-1);const x=map.get(-2);if(crv!==6||alg!==-8||!(x instanceof Uint8Array)){throw new Error("Unsupported OKP key: only Ed25519 (crv: 6, alg: -8) is supported")}const algorithmParams={name:"Ed25519"};const cryptoKey=await crypto.subtle.importKey("raw",x,algorithmParams,true,["verify"]);return{kty,alg,cryptoKey,algorithmParams}}if(kty===3){const n=map.get(-1);const e=map.get(-2);if(!n||!e||!(n instanceof Uint8Array)||!(e instanceof Uint8Array)){throw new Error("Invalid COSE RSA Key: Missing or invalid modulus or exponent")}let hashName="SHA-256";let jwkAlg="RS256";if(alg===-258){hashName="SHA-384";jwkAlg="RS384"}else if(alg===-259){hashName="SHA-512";jwkAlg="RS512"}else if(alg===-37){hashName="SHA-256";jwkAlg="PS256"}const keyAlgo=alg===-37?"RSA-PSS":"RSASSA-PKCS1-v1_5";const jwk={kty:"RSA",alg:jwkAlg,n:bytesToBase64URL(n),e:bytesToBase64URL(e),ext:true};const algorithmParams={name:keyAlgo,hash:{name:hashName}};const cryptoKey=await crypto.subtle.importKey("jwk",jwk,algorithmParams,true,["verify"]);return{kty,alg,cryptoKey,algorithmParams}}throw new Error(`Unsupported COSE Key Type: ${kty}`)}function parseAuthenticatorExtensions(extensionBytes){const{value,rawSlice}=decodeCBORWithSlice(extensionBytes);if(!(value instanceof Map)){return{extensions:{},bytesConsumed:rawSlice.byteLength}}const extensions={raw:value};const credPropsVal=value.get("credProps");if(credPropsVal instanceof Map){extensions.credProps={rk:Boolean(credPropsVal.get("rk"))}}const prfVal=value.get("prf");if(prfVal instanceof Map){const resultsVal=prfVal.get("results");if(resultsVal instanceof Map){const first=resultsVal.get("first");const second=resultsVal.get("second");extensions.prf={enabled:true,results:{first:first instanceof Uint8Array?first:undefined,second:second instanceof Uint8Array?second:undefined}}}else{extensions.prf={enabled:Boolean(prfVal.get("enabled")??true)}}}const largeBlobVal=value.get("largeBlob");if(largeBlobVal instanceof Map){const blob=largeBlobVal.get("blob");const written=largeBlobVal.get("written");extensions.largeBlob={supported:Boolean(largeBlobVal.get("supported")??true),blob:blob instanceof Uint8Array?blob:undefined,written:typeof written==="boolean"?written:undefined}}const appIdVal=value.get("appid");if(typeof appIdVal==="boolean"){extensions.appId=appIdVal}return{extensions,bytesConsumed:rawSlice.byteLength}}class WebAuthnError extends Error{code;details;constructor(code,message,details){super(message);this.name="WebAuthnError";this.code=code;this.details=details;Object.setPrototypeOf(this,new.target.prototype)}}class ChallengeMismatchError extends WebAuthnError{constructor(expected,received){super("CHALLENGE_MISMATCH",`Challenge mismatch. Expected '${expected}', received '${received}'`,{expected,received});this.name="ChallengeMismatchError"}}class OriginMismatchError extends WebAuthnError{constructor(expected,received){super("ORIGIN_MISMATCH",`Origin mismatch. Received origin '${received}' is not allowed`,{expected,received});this.name="OriginMismatchError"}}class RpIdMismatchError extends WebAuthnError{constructor(expectedRpId){super("RP_ID_MISMATCH",`RP ID hash in authenticatorData does not match expected RP ID '${expectedRpId}'`,{expectedRpId});this.name="RpIdMismatchError"}}class UserPresenceError extends WebAuthnError{constructor(){super("USER_PRESENCE_NOT_SET","User Presence (UP) flag was not set by authenticator");this.name="UserPresenceError"}}class UserVerificationPolicyError extends WebAuthnError{constructor(){super("USER_VERIFICATION_FAILED","User Verification (UV) was required but flag was not set by authenticator");this.name="UserVerificationPolicyError"}}class CounterRollbackError extends WebAuthnError{constructor(storedCount,receivedCount){super("COUNTER_ROLLBACK",`Authenticator counter rollback detected! Potential cloned authenticator. Stored: ${storedCount}, Received: ${receivedCount}`,{storedCount,receivedCount});this.name="CounterRollbackError"}}class InvalidSignatureError extends WebAuthnError{constructor(message="Cryptographic signature is invalid"){super("INVALID_SIGNATURE",message);this.name="InvalidSignatureError"}}class MalformedPayloadError extends WebAuthnError{constructor(message,details){super("MALFORMED_PAYLOAD",message,details);this.name="MalformedPayloadError"}}function parseAuthenticatorData(authDataBytes){if(authDataBytes.byteLength<37){throw new MalformedPayloadError(`authenticatorData too short: Expected >= 37 bytes, got ${authDataBytes.byteLength}`)}const reader=new BinaryReader(authDataBytes);const rpIdHash=reader.readBytes(32);const flagByte=reader.readUint8();const flags={up:(flagByte&1)!==0,uv:(flagByte&4)!==0,be:(flagByte&8)!==0,bs:(flagByte&16)!==0,at:(flagByte&64)!==0,ed:(flagByte&128)!==0,raw:flagByte};const signCount=reader.readUint32();let aaguid;let credentialId;let credentialPublicKey;let extensions;if(flags.at){if(reader.remaining<18){throw new MalformedPayloadError("authenticatorData has AT flag set but lacks attested credential data")}aaguid=reader.readBytes(16);const credIdLen=reader.readUint16();if(reader.remaining<credIdLen){throw new MalformedPayloadError(`authenticatorData credentialId truncated: expected ${credIdLen} bytes, remaining ${reader.remaining}`)}credentialId=reader.readBytes(credIdLen);const remainingBytes=authDataBytes.subarray(reader.cursor);const{rawSlice}=decodeCBORWithSlice(remainingBytes);credentialPublicKey=rawSlice;reader.seek(reader.cursor+rawSlice.byteLength)}if(flags.ed&&reader.remaining>0){const extBytes=authDataBytes.subarray(reader.cursor);const{extensions:parsedExts,bytesConsumed}=parseAuthenticatorExtensions(extBytes);extensions=parsedExts;reader.seek(reader.cursor+bytesConsumed)}return{rpIdHash,flags,signCount,aaguid,credentialId,credentialPublicKey,extensions,raw:authDataBytes}}function formatAAGUID(aaguid){const hex=Array.from(aaguid,(b)=>b.toString(16).padStart(2,"0")).join("");return`${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`}async function parseAndVerifyClientData(clientDataInput,expectedType){let rawJson;let rawBytes;if(typeof clientDataInput==="string"){if(clientDataInput.trim().startsWith("{")){rawJson=clientDataInput;rawBytes=new TextEncoder().encode(rawJson)}else{rawBytes=base64URLToBytes(clientDataInput);rawJson=new TextDecoder("utf-8").decode(rawBytes)}}else{rawBytes=clientDataInput;rawJson=new TextDecoder("utf-8").decode(rawBytes)}let parsed;try{parsed=JSON.parse(rawJson)}catch{throw new MalformedPayloadError("clientDataJSON is not valid JSON")}if(parsed.type!==expectedType){throw new MalformedPayloadError(`clientDataJSON type mismatch: expected '${expectedType}', received '${parsed.type}'`)}if(!parsed.challenge||typeof parsed.challenge!=="string"){throw new MalformedPayloadError("clientDataJSON missing challenge string")}if(!parsed.origin||typeof parsed.origin!=="string"){throw new MalformedPayloadError("clientDataJSON missing origin string")}const digestBuffer=await crypto.subtle.digest("SHA-256",rawBytes);const sha256=new Uint8Array(digestBuffer);return{type:parsed.type,challenge:parsed.challenge,origin:parsed.origin,crossOrigin:parsed.crossOrigin,rawJson,sha256}}function derToIEEEP1363(derSignature,keyCoordinateLength=32){if(derSignature.length===keyCoordinateLength*2){return derSignature}const reader=new BinaryReader(derSignature);const seqTag=reader.readUint8();if(seqTag!==48){throw new MalformedPayloadError(`Invalid DER signature: Expected SEQUENCE tag 0x30, got 0x${seqTag.toString(16)}`)}const seqLength=readDerLength(reader);if(seqLength>reader.remaining){throw new MalformedPayloadError("Invalid DER signature: SEQUENCE length exceeds available buffer")}const rBytes=readDerInteger(reader);const sBytes=readDerInteger(reader);const p1363=new Uint8Array(keyCoordinateLength*2);copyPaddedInteger(rBytes,p1363,0,keyCoordinateLength);copyPaddedInteger(sBytes,p1363,keyCoordinateLength,keyCoordinateLength);return p1363}function readDerLength(reader){const initial=reader.readUint8();if((initial&128)===0)return initial;const numOctets=initial&127;if(numOctets===1)return reader.readUint8();if(numOctets===2)return reader.readUint16();throw new MalformedPayloadError(`Unsupported DER multi-byte length: ${numOctets} octets`)}function readDerInteger(reader){const tag=reader.readUint8();if(tag!==2){throw new MalformedPayloadError(`Invalid DER signature: Expected INTEGER tag 0x02, got 0x${tag.toString(16)}`)}const length=readDerLength(reader);return reader.readBytes(length)}function copyPaddedInteger(source,target,targetOffset,targetLength){let src=source;while(src.length>targetLength&&src[0]===0){src=src.subarray(1)}if(src.length>targetLength){throw new MalformedPayloadError(`DER integer length (${src.length}) exceeds maximum expected coordinate length (${targetLength})`)}const paddingOffset=targetLength-src.length;target.fill(0,targetOffset,targetOffset+paddingOffset);target.set(src,targetOffset+paddingOffset)}async function verifyOrigin(receivedOrigin,expectedOrigin,allowCrossOrigin=false,crossOriginFlag){if(!allowCrossOrigin&&crossOriginFlag===true){throw new OriginMismatchError(Array.isArray(expectedOrigin)?expectedOrigin:typeof expectedOrigin==="string"?expectedOrigin:"custom validator",`${receivedOrigin} (crossOrigin flag was true)`)}if(typeof expectedOrigin==="function"){const isValid=await expectedOrigin(receivedOrigin);if(!isValid){throw new OriginMismatchError("custom validation predicate",receivedOrigin)}return}const allowedList=Array.isArray(expectedOrigin)?expectedOrigin:[expectedOrigin];const matched=allowedList.some((allowed)=>{if(allowed===receivedOrigin)return true;const normAllowed=allowed.replace(/\/+$/,"");const normReceived=receivedOrigin.replace(/\/+$/,"");if(normAllowed===normReceived)return true;if(normAllowed.startsWith("android:apk-key-hash:")&&normReceived===normAllowed){return true}if(normAllowed.startsWith("webauthn.bundle:")&&normReceived===normAllowed){return true}return false});if(!matched){throw new OriginMismatchError(allowedList,receivedOrigin)}}async function verifyRegistration(options){const{response,expectedChallenge,expectedOrigin,expectedRpId,requireUserVerification=false,allowCrossOrigin=false}=options;const clientData=await parseAndVerifyClientData(response.response.clientDataJSON,"webauthn.create");const expectedChallengeBytes=typeof expectedChallenge==="string"?new TextEncoder().encode(expectedChallenge):expectedChallenge;const clientChallengeBytes=new TextEncoder().encode(clientData.challenge);if(!timingSafeEqual(expectedChallengeBytes,clientChallengeBytes)&&expectedChallenge!==clientData.challenge){throw new ChallengeMismatchError(expectedChallenge,clientData.challenge)}await verifyOrigin(clientData.origin,expectedOrigin,allowCrossOrigin,clientData.crossOrigin);const attestationInput=response.response.attestationObject;const attestationBytes=typeof attestationInput==="string"?base64URLToBytes(attestationInput):attestationInput;const attestationMap=decodeCBOR(attestationBytes);if(!(attestationMap instanceof Map)){throw new MalformedPayloadError("Invalid attestationObject: Expected CBOR Map")}const rawAuthData=attestationMap.get("authData");if(!rawAuthData||!(rawAuthData instanceof Uint8Array)){throw new MalformedPayloadError("Invalid attestationObject: Missing authData bytes")}const authData=parseAuthenticatorData(rawAuthData);const expectedRpIdHash=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(expectedRpId)));if(!timingSafeEqual(expectedRpIdHash,authData.rpIdHash)){throw new RpIdMismatchError(expectedRpId)}if(!authData.flags.up){throw new UserPresenceError}if(requireUserVerification&&!authData.flags.uv){throw new UserVerificationPolicyError}if(!authData.flags.at||!authData.credentialId||!authData.credentialPublicKey||!authData.aaguid){throw new MalformedPayloadError("Attested credential data missing in registration response")}const credentialIdB64=bytesToBase64URL(authData.credentialId);const aaguidFormatted=formatAAGUID(authData.aaguid);return{verified:true,credential:{id:credentialIdB64,publicKey:authData.credentialPublicKey,aaguid:aaguidFormatted,signCount:authData.signCount,backupEligible:authData.flags.be,backupState:authData.flags.bs},extensions:authData.extensions}}async function verifyAuthentication(options){const{response,expectedChallenge,expectedOrigin,expectedRpId,credentialPublicKey,prevSignCount=0,requireUserVerification=false,allowCrossOrigin=false}=options;const clientData=await parseAndVerifyClientData(response.response.clientDataJSON,"webauthn.get");const expectedChallengeBytes=typeof expectedChallenge==="string"?new TextEncoder().encode(expectedChallenge):expectedChallenge;const clientChallengeBytes=new TextEncoder().encode(clientData.challenge);if(!timingSafeEqual(expectedChallengeBytes,clientChallengeBytes)&&expectedChallenge!==clientData.challenge){throw new ChallengeMismatchError(expectedChallenge,clientData.challenge)}await verifyOrigin(clientData.origin,expectedOrigin,allowCrossOrigin,clientData.crossOrigin);const authDataInput=response.response.authenticatorData;const authDataBytes=typeof authDataInput==="string"?base64URLToBytes(authDataInput):authDataInput;const authData=parseAuthenticatorData(authDataBytes);const expectedRpIdHash=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(expectedRpId)));if(!timingSafeEqual(expectedRpIdHash,authData.rpIdHash)){throw new RpIdMismatchError(expectedRpId)}if(!authData.flags.up){throw new UserPresenceError}if(requireUserVerification&&!authData.flags.uv){throw new UserVerificationPolicyError}if(authData.signCount>0||prevSignCount>0){if(authData.signCount<=prevSignCount&&!authData.flags.be){throw new CounterRollbackError(prevSignCount,authData.signCount)}}const signedData=new Uint8Array(authDataBytes.byteLength+clientData.sha256.byteLength);signedData.set(authDataBytes,0);signedData.set(clientData.sha256,authDataBytes.byteLength);const parsedKey=await importCOSEPublicKey(credentialPublicKey);const rawSigInput=response.response.signature;const rawSigBytes=typeof rawSigInput==="string"?base64URLToBytes(rawSigInput):rawSigInput;let normalizedSig=rawSigBytes;if(parsedKey.alg===-7||parsedKey.alg===-35||parsedKey.alg===-36){const coordLen=parsedKey.alg===-35?48:parsedKey.alg===-36?66:32;normalizedSig=derToIEEEP1363(rawSigBytes,coordLen)}const isValid=await crypto.subtle.verify(parsedKey.algorithmParams,parsedKey.cryptoKey,normalizedSig,signedData);if(!isValid){throw new InvalidSignatureError("Authentication signature verification failed")}return{verified:true,newSignCount:authData.signCount,userPresent:authData.flags.up,userVerified:authData.flags.uv,backupState:authData.flags.bs,extensions:authData.extensions}}function generateRegistrationOptions(args){const{rpName,rpId,userName,userDisplayName=userName.split("@")[0],timeout=60000,attestationType="none",residentKey="preferred",userVerification="preferred",authenticatorAttachment,supportedAlgorithms=[-7,-8,-257],excludeCredentials,extensions}=args;let challengeStr;if(!args.challenge){const raw=new Uint8Array(32);crypto.getRandomValues(raw);challengeStr=bytesToBase64URL(raw)}else if(typeof args.challenge==="string"){challengeStr=args.challenge}else{challengeStr=bytesToBase64URL(args.challenge)}let userIdStr;if(!args.userID){const rawId=new Uint8Array(16);crypto.getRandomValues(rawId);userIdStr=bytesToBase64URL(rawId)}else if(typeof args.userID==="string"){userIdStr=bytesToBase64URL(new TextEncoder().encode(args.userID))}else{userIdStr=bytesToBase64URL(args.userID)}const pubKeyCredParams=supportedAlgorithms.map((alg)=>({type:"public-key",alg}));const authenticatorSelection={residentKey,userVerification};if(authenticatorAttachment){authenticatorSelection.authenticatorAttachment=authenticatorAttachment}const options={challenge:challengeStr,rp:{name:rpName,id:rpId},user:{id:userIdStr,name:userName,displayName:userDisplayName},pubKeyCredParams,timeout,attestation:attestationType,authenticatorSelection};if(excludeCredentials&&excludeCredentials.length>0){options.excludeCredentials=excludeCredentials.map((cred)=>({id:typeof cred.id==="string"?cred.id:bytesToBase64URL(cred.id),type:"public-key",transports:cred.transports}))}if(extensions){options.extensions=extensions}return options}function generateAuthenticationOptions(args){const{rpId,timeout=60000,userVerification="preferred",allowCredentials,extensions}=args;let challengeStr;if(!args.challenge){const raw=new Uint8Array(32);crypto.getRandomValues(raw);challengeStr=bytesToBase64URL(raw)}else if(typeof args.challenge==="string"){challengeStr=args.challenge}else{challengeStr=bytesToBase64URL(args.challenge)}const options={challenge:challengeStr,rpId,timeout,userVerification};if(allowCredentials&&allowCredentials.length>0){options.allowCredentials=allowCredentials.map((cred)=>({id:typeof cred.id==="string"?cred.id:bytesToBase64URL(cred.id),type:"public-key",transports:cred.transports}))}if(extensions){options.extensions=extensions}return options}export{BinaryReader,COSEAlgorithm,COSECurve,COSEKeyType,ChallengeMismatchError,CounterRollbackError,InvalidSignatureError,MalformedPayloadError,OriginMismatchError,RpIdMismatchError,UserPresenceError,UserVerificationPolicyError,WebAuthnError,base64URLToBytes,bytesToBase64URL,decodeCBOR,decodeCBORWithSlice,derToIEEEP1363,formatAAGUID,generateAuthenticationOptions,generateRegistrationOptions,importCOSEPublicKey,parseAndVerifyClientData,parseAuthenticatorData,parseAuthenticatorExtensions,timingSafeEqual,verifyAuthentication,verifyOrigin,verifyRegistration};

package/dist/protocol/authData.d.ts

@@ -0,0 +1,9 @@
+import type { ParsedAuthData } from "@/types";
+/**
+ * Parses raw binary authenticatorData, unpacking flags, counters, and credential structures.
+ */
+export declare function parseAuthenticatorData(authDataBytes: Uint8Array): ParsedAuthData;
+/**
+ * Formats a 16-byte AAGUID into a canonical UUID string (8-4-4-4-12).
+ */
+export declare function formatAAGUID(aaguid: Uint8Array): string;

package/dist/protocol/clientData.d.ts

@@ -0,0 +1,5 @@
+import type { ParsedClientData } from "@/types";
+/**
+ * Validates the clientDataJSON string and computes its SHA-256 hash.
+ */
+export declare function parseAndVerifyClientData(clientDataInput: string | Uint8Array, expectedType: "webauthn.create" | "webauthn.get"): Promise<ParsedClientData>;

package/dist/protocol/der.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Normalizes an ASN.1 DER ECDSA signature into a fixed-length IEEE P1363 (r || s) byte array.
+ */
+export declare function derToIEEEP1363(derSignature: Uint8Array, keyCoordinateLength?: number): Uint8Array;

package/dist/protocol/extensions.d.ts

@@ -0,0 +1,29 @@
+import { CBORValue } from "@/binary";
+export interface CredentialPropertiesExtension {
+    rk?: boolean;
+}
+export interface PRFExtensionResults {
+    first?: Uint8Array;
+    second?: Uint8Array;
+}
+export interface ParsedExtensions {
+    credProps?: CredentialPropertiesExtension;
+    prf?: {
+        enabled?: boolean;
+        results?: PRFExtensionResults;
+    };
+    largeBlob?: {
+        supported?: boolean;
+        blob?: Uint8Array;
+        written?: boolean;
+    };
+    appId?: boolean;
+    raw?: Map<string | number, CBORValue>;
+}
+/**
+ * Parses trailing CBOR extension map from authenticatorData when the ED flag is present.
+ */
+export declare function parseAuthenticatorExtensions(extensionBytes: Uint8Array): {
+    extensions: ParsedExtensions;
+    bytesConsumed: number;
+};

package/dist/protocol/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./authData";
+export * from "./clientData";
+export * from "./der";
+export * from "./origin";
+export * from "./extensions";

package/dist/protocol/origin.d.ts

@@ -0,0 +1,5 @@
+export type ExpectedOrigin = string | string[] | ((origin: string) => boolean | Promise<boolean>);
+/**
+ * Validates the clientData origin against allowed origins, wildcards, or mobile app facet identifiers.
+ */
+export declare function verifyOrigin(receivedOrigin: string, expectedOrigin: ExpectedOrigin, allowCrossOrigin?: boolean, crossOriginFlag?: boolean): Promise<void>;

package/dist/types/cose.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Supported COSE algorithm identifiers.
+ */
+export declare enum COSEAlgorithm {
+    ES256 = -7,
+    EdDSA = -8,
+    ES384 = -35,
+    ES512 = -36,
+    RS256 = -257,
+    RS384 = -258,
+    RS512 = -259,
+    PS256 = -37
+}
+/**
+ * Supported COSE key types.
+ */
+export declare enum COSEKeyType {
+    OKP = 1,
+    EC2 = 2,
+    RSA = 3
+}
+/**
+ * Supported COSE elliptic curves.
+ */
+export declare enum COSECurve {
+    P256 = 1,
+    P384 = 2,
+    P521 = 3,
+    Ed25519 = 6
+}

package/dist/types/flags.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Bitfield flags parsed from authenticator data.
+ */
+export interface AuthenticatorFlags {
+    up: boolean;
+    uv: boolean;
+    be: boolean;
+    bs: boolean;
+    at: boolean;
+    ed: boolean;
+    raw: number;
+}

package/dist/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./cose";
+export * from "./flags";
+export * from "./models";

package/dist/types/models.d.ts

@@ -0,0 +1,103 @@
+import type { AuthenticatorFlags } from "./flags";
+import type { COSEAlgorithm, COSEKeyType } from "./cose";
+import type { ParsedExtensions } from "@/protocol/extensions";
+import type { ExpectedOrigin } from "@/protocol/origin";
+/**
+ * Parsed binary authenticator data structure.
+ */
+export interface ParsedAuthData {
+    rpIdHash: Uint8Array;
+    flags: AuthenticatorFlags;
+    signCount: number;
+    aaguid?: Uint8Array;
+    credentialId?: Uint8Array;
+    credentialPublicKey?: Uint8Array;
+    extensions?: ParsedExtensions;
+    raw: Uint8Array;
+}
+/**
+ * Parsed and validated clientDataJSON payload.
+ */
+export interface ParsedClientData {
+    type: string;
+    challenge: string;
+    origin: string;
+    crossOrigin?: boolean;
+    rawJson: string;
+    sha256: Uint8Array;
+}
+/**
+ * Imported WebCrypto public key with associated COSE metadata.
+ */
+export interface ParsedCOSEKey {
+    kty: COSEKeyType;
+    alg: COSEAlgorithm;
+    cryptoKey: CryptoKey;
+    algorithmParams: AlgorithmIdentifier | RsaHashedImportParams | EcKeyImportParams;
+}
+/**
+ * Input parameters for verifying a WebAuthn registration response.
+ */
+export interface RegistrationVerificationOptions {
+    response: {
+        id: string;
+        rawId: string;
+        response: {
+            clientDataJSON: string | Uint8Array;
+            attestationObject: string | Uint8Array;
+        };
+    };
+    expectedChallenge: string;
+    expectedOrigin: ExpectedOrigin;
+    expectedRpId: string;
+    requireUserVerification?: boolean;
+    allowCrossOrigin?: boolean;
+}
+/**
+ * Verification outcome containing the newly enrolled credential.
+ */
+export interface RegistrationResult {
+    verified: boolean;
+    credential: {
+        id: string;
+        publicKey: Uint8Array;
+        aaguid: string;
+        signCount: number;
+        backupEligible: boolean;
+        backupState: boolean;
+    };
+    extensions?: ParsedExtensions;
+}
+/**
+ * Input parameters for verifying a WebAuthn authentication assertion response.
+ */
+export interface AuthenticationVerificationOptions {
+    response: {
+        id: string;
+        rawId: string;
+        response: {
+            clientDataJSON: string | Uint8Array;
+            authenticatorData: string | Uint8Array;
+            signature: string | Uint8Array;
+            userHandle?: string;
+        };
+    };
+    expectedChallenge: string;
+    expectedOrigin: ExpectedOrigin;
+    expectedRpId: string;
+    credentialPublicKey: Uint8Array;
+    prevSignCount?: number;
+    requireUserVerification?: boolean;
+    allowCrossOrigin?: boolean;
+}
+/**
+ * Verification outcome of an authentication assertion.
+ */
+export interface AuthenticationResult {
+    verified: boolean;
+    newSignCount: number;
+    userPresent: boolean;
+    userVerified: boolean;
+    backupState: boolean;
+    extensions?: ParsedExtensions;
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@muljax/edge-passkey",
+  "version": "1.0.0",
+  "description": "Zero-dependency, high-performance WebAuthn / Passkey verification engine for edge runtimes (Cloudflare Workers, Bun, Deno, Node)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/muljax/edge-passkey.git"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "dev": "bun --watch server/index.ts",
+    "start": "bun server/index.ts",
+    "build": "bun build ./src/index.ts --outdir ./dist --target browser --minify-whitespace && tsc -p tsconfig.build.json",
+    "prepublishOnly": "bun test && bun run build",
+    "test": "bun test",
+    "bench": "bun benchmarks/benchmark.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "webauthn",
+    "passkey",
+    "fido2",
+    "edge",
+    "cloudflare-workers",
+    "bun",
+    "webcrypto",
+    "zero-dependency"
+  ],
+  "author": "",
+  "license": "MPL-2.0",
+  "devDependencies": {
+    "@simplewebauthn/server": "^14.0.3",
+    "@types/bun": "latest",
+    "typescript": "^5.5.0"
+  }
+}