@navette-js/panels 1.0.0-beta.3 → 1.0.0-beta.5

package/lib/totp.js

@@ -0,0 +1,104 @@
+// Time-based one-time passwords (RFC 6238, on HOTP: RFC 4226), as used by authenticator apps
+// (Google Authenticator, Microsoft Authenticator, 1Password, Authy…). No dependency: HMAC from `node:crypto`.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/** RFC 4648 base32, without padding (the format of authenticator app secrets). */
+export function base32Encode(bytes) {
+    let bits = 0, value = 0, output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        output += ALPHABET[(value << (5 - bits)) & 31];
+    return output;
+}
+/** Decodes base32 (case, spaces and padding ignored). Throws on any other character. */
+export function base32Decode(text) {
+    const clean = text.toUpperCase().replace(/[\s=-]/g, '');
+    const bytes = [];
+    let bits = 0, value = 0;
+    for (const char of clean) {
+        const index = ALPHABET.indexOf(char);
+        if (index < 0)
+            throw new Error('Invalid base32 character.');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+const defaults = (options = {}) => ({ period: options.period ?? 30, digits: options.digits ?? 6, algorithm: options.algorithm ?? 'sha1' });
+/** Random base32 secret of `bytes` bytes (20 by default: 160 bits, as RFC 4226 recommends). */
+export function generateTotpSecret(bytes = 20) { return base32Encode(randomBytes(bytes)); }
+/** HOTP value for a counter. */
+export function hotp(secret, counter, options = {}) {
+    const { digits, algorithm } = defaults(options);
+    const key = typeof secret === 'string' ? base32Decode(secret) : Buffer.from(secret);
+    const message = Buffer.alloc(8);
+    message.writeBigUInt64BE(BigInt(counter));
+    const hash = createHmac(algorithm, key).update(message).digest();
+    const offset = hash[hash.length - 1] & 15;
+    const binary = ((hash[offset] & 127) << 24) | (hash[offset + 1] << 16) | (hash[offset + 2] << 8) | hash[offset + 3];
+    return String(binary % 10 ** digits).padStart(digits, '0');
+}
+/** Time step (counter) of a moment: `floor(unix seconds / period)`. */
+export const totpTimestep = (at = Date.now(), period = 30) => Math.floor(at / 1000 / period);
+/** Current code of a secret (or the code at `at`, in milliseconds). */
+export function totpCode(secret, options = {}) {
+    const { period } = defaults(options);
+    return hotp(secret, totpTimestep(options.at, period), options);
+}
+/**
+ * Checks a code against the secret, accepting `window` time steps before and after the current one (clock drift).
+ * Returns the matched time step, or `null`. Pass the last accepted step as `after` to refuse a code that was already
+ * used, or any older one (RFC 6238 §5.2): store the returned step and pass it next time.
+ */
+export function verifyTotp(secret, code, options = {}) {
+    const { period, digits } = defaults(options);
+    const value = String(code ?? '').replace(/\s/g, '');
+    if (!new RegExp(`^\\d{${digits}}$`).test(value))
+        return null;
+    let key;
+    try {
+        key = base32Decode(secret);
+    }
+    catch {
+        return null;
+    }
+    if (!key.length)
+        return null;
+    const current = totpTimestep(options.at, period);
+    const window = Math.max(0, Math.min(10, Math.floor(options.window ?? 1)));
+    let matched = null;
+    // Every candidate is computed and compared in constant time, so the response time does not reveal which step matched.
+    for (let step = current - window; step <= current + window; step++) {
+        const candidate = Buffer.from(hotp(key, step, options));
+        if (timingSafeEqual(candidate, Buffer.from(value)) && matched === null && (options.after === null || options.after === undefined || step > options.after))
+            matched = step;
+    }
+    return matched;
+}
+/**
+ * `otpauth://` URI to show as a QR code: `issuer` is the application name, `account` the user's (their email).
+ * See https://github.com/google/google-authenticator/wiki/Key-Uri-Format.
+ */
+export function totpUri(secret, account, issuer, options = {}) {
+    const { period, digits, algorithm } = defaults(options);
+    const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(account)}`;
+    const params = new URLSearchParams({ secret, issuer });
+    if (algorithm !== 'sha1')
+        params.set('algorithm', algorithm.toUpperCase());
+    if (digits !== 6)
+        params.set('digits', String(digits));
+    if (period !== 30)
+        params.set('period', String(period));
+    return `otpauth://totp/${label}?${params.toString().replace(/\+/g, '%20')}`;
+}

package/lib/webauthn.d.ts

@@ -0,0 +1,155 @@
+import { type KeyObject } from 'node:crypto';
+export declare class WebAuthnError extends Error {
+}
+/** Decodes one CBOR item at `offset`; returns it with the offset after it. Maps are returned as `Map`. */
+export declare function decodeCborItem(bytes: Uint8Array, offset?: number, depth?: number): [unknown, number];
+export declare const decodeCbor: (bytes: Uint8Array) => unknown;
+/** COSE algorithms supported: ES256, EdDSA (Ed25519), ES384, ES512, RS256. */
+export declare const SUPPORTED_ALGORITHMS: readonly [-8, -7, -257, -35, -36];
+/** Public key of a COSE key map. */
+export declare function coseToPublicKey(cose: Map<unknown, unknown>): {
+    algorithm: number;
+    key: KeyObject;
+};
+/** Checks an assertion signature with a stored public key (SPKI DER, base64url). */
+export declare function verifySignature(algorithm: number, publicKey: string, data: Buffer, signature: Buffer): boolean;
+export type AuthenticatorData = {
+    rpIdHash: Buffer;
+    userPresent: boolean;
+    userVerified: boolean;
+    backupEligible: boolean;
+    backedUp: boolean;
+    signCount: number;
+    attestedCredential: {
+        aaguid: string;
+        credentialId: Buffer;
+        publicKey: Map<unknown, unknown>;
+    } | null;
+};
+export declare function parseAuthenticatorData(data: Buffer): AuthenticatorData;
+export type UserVerification = 'required' | 'preferred' | 'discouraged';
+/** What the browser sends after `navigator.credentials.create()` (the credential's `toJSON()`). */
+export type RegistrationResponseJSON = {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        transports?: string[];
+    };
+};
+/** What the browser sends after `navigator.credentials.get()`. */
+export type AuthenticationResponseJSON = {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | null;
+    };
+};
+export type ExpectedCeremony = {
+    /** Challenge sent to the browser (base64url). */
+    challenge: string;
+    /** Origins allowed (`https://example.com`, with a port if not standard). */
+    origin: string | string[];
+    /** Relying party id: the domain (`example.com`), without scheme or port. */
+    rpId: string;
+    /** Require the authenticator to verify the user (PIN, biometrics): `true` for passkeys used without a password. */
+    requireUserVerification?: boolean;
+};
+/** A registered credential, as stored. */
+export type StoredCredential = {
+    credentialId: string;
+    publicKey: string;
+    algorithm: number;
+    signCount: number;
+    transports?: string[];
+};
+/** Verifies a registration (`navigator.credentials.create()`), and returns the credential to store. Throws `WebAuthnError`. */
+export declare function verifyRegistration(response: unknown, expected: ExpectedCeremony): StoredCredential & {
+    aaguid: string;
+    backedUp: boolean;
+    userVerified: boolean;
+};
+/**
+ * Verifies an authentication (`navigator.credentials.get()`) against the stored credential whose id the response carries.
+ * Returns the new signature counter, to store. Throws `WebAuthnError`, notably when the counter went backwards (cloned key).
+ */
+export declare function verifyAuthentication(response: unknown, expected: ExpectedCeremony & {
+    credential: StoredCredential;
+}): {
+    signCount: number;
+    userVerified: boolean;
+};
+/** Random challenge (base64url, 32 bytes). */
+export declare const generateChallenge: () => string;
+/** Options for `navigator.credentials.create()`, as JSON (`PublicKeyCredential.parseCreationOptionsFromJSON()`). */
+export declare function registrationOptions(options: {
+    rpId: string;
+    rpName: string;
+    userId: string;
+    userName: string;
+    userDisplayName?: string;
+    challenge: string;
+    excludeCredentials?: {
+        credentialId: string;
+        transports?: string[];
+    }[];
+    userVerification?: UserVerification;
+    residentKey?: 'required' | 'preferred' | 'discouraged';
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+    timeout?: number;
+}): {
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    challenge: string;
+    pubKeyCredParams: {
+        type: string;
+        alg: -8 | -7 | -257 | -35 | -36;
+    }[];
+    timeout: number;
+    excludeCredentials: {
+        transports?: string[];
+        type: string;
+        id: string;
+    }[];
+    authenticatorSelection: {
+        authenticatorAttachment?: "platform" | "cross-platform";
+        residentKey: "required" | "preferred" | "discouraged";
+        requireResidentKey: boolean;
+        userVerification: UserVerification;
+    };
+    attestation: string;
+};
+/** Options for `navigator.credentials.get()`, as JSON (`PublicKeyCredential.parseRequestOptionsFromJSON()`). */
+export declare function authenticationOptions(options: {
+    rpId: string;
+    challenge: string;
+    allowCredentials?: {
+        credentialId: string;
+        transports?: string[];
+    }[];
+    userVerification?: UserVerification;
+    timeout?: number;
+}): {
+    rpId: string;
+    challenge: string;
+    timeout: number;
+    allowCredentials: {
+        transports?: string[];
+        type: string;
+        id: string;
+    }[];
+    userVerification: UserVerification;
+};

package/lib/webauthn.js

@@ -0,0 +1,287 @@
+// WebAuthn (Web Authentication, level 2) relying party: registration and authentication ceremonies for security keys
+// and passkeys. No dependency: CBOR and COSE parsing, signature checks with `node:crypto`.
+// Attestation statements are not verified (`attestation: 'none'`): the key proves possession, not its make or model.
+import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify } from 'node:crypto';
+export class WebAuthnError extends Error {
+}
+const b64url = (bytes) => Buffer.from(bytes).toString('base64url');
+const fromB64url = (value, what) => {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]*={0,2}$/.test(value) || value.length > 100_000)
+        throw new WebAuthnError(`Invalid ${what}.`);
+    return Buffer.from(value, 'base64url');
+};
+// --- CBOR (RFC 8949): the definite-length subset that authenticators produce.
+/** Decodes one CBOR item at `offset`; returns it with the offset after it. Maps are returned as `Map`. */
+export function decodeCborItem(bytes, offset = 0, depth = 0) {
+    if (depth > 16)
+        throw new WebAuthnError('CBOR nesting too deep.');
+    const need = (count) => { if (offset + count > bytes.length)
+        throw new WebAuthnError('Truncated CBOR data.'); };
+    need(1);
+    const initial = bytes[offset++];
+    const major = initial >> 5, info = initial & 31;
+    let length;
+    if (info < 24)
+        length = info;
+    else if (info === 24) {
+        need(1);
+        length = bytes[offset];
+        offset += 1;
+    }
+    else if (info === 25) {
+        need(2);
+        length = (bytes[offset] << 8) | bytes[offset + 1];
+        offset += 2;
+    }
+    else if (info === 26) {
+        need(4);
+        length = Buffer.from(bytes.subarray(offset, offset + 4)).readUInt32BE(0);
+        offset += 4;
+    }
+    else if (info === 27) {
+        need(8);
+        const big = Buffer.from(bytes.subarray(offset, offset + 8)).readBigUInt64BE(0);
+        offset += 8;
+        if (big > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new WebAuthnError('CBOR integer too large.');
+        length = Number(big);
+    }
+    else
+        throw new WebAuthnError('Unsupported CBOR encoding.');
+    switch (major) {
+        case 0: return [length, offset];
+        case 1: return [-1 - length, offset];
+        case 2:
+            need(length);
+            return [Buffer.from(bytes.subarray(offset, offset + length)), offset + length];
+        case 3:
+            need(length);
+            return [Buffer.from(bytes.subarray(offset, offset + length)).toString('utf8'), offset + length];
+        case 4: {
+            if (length > 10_000)
+                throw new WebAuthnError('CBOR array too long.');
+            const items = [];
+            for (let i = 0; i < length; i++) {
+                const [item, next] = decodeCborItem(bytes, offset, depth + 1);
+                items.push(item);
+                offset = next;
+            }
+            return [items, offset];
+        }
+        case 5: {
+            if (length > 10_000)
+                throw new WebAuthnError('CBOR map too long.');
+            const map = new Map();
+            for (let i = 0; i < length; i++) {
+                const [key, afterKey] = decodeCborItem(bytes, offset, depth + 1);
+                const [value, afterValue] = decodeCborItem(bytes, afterKey, depth + 1);
+                map.set(key, value);
+                offset = afterValue;
+            }
+            return [map, offset];
+        }
+        case 6: return decodeCborItem(bytes, offset, depth + 1); // tag: its content
+        default: {
+            if (info === 20)
+                return [false, offset];
+            if (info === 21)
+                return [true, offset];
+            if (info === 22 || info === 23)
+                return [null, offset];
+            if (info === 25) {
+                const half = length, exponent = (half >> 10) & 31, fraction = half & 1023;
+                const value = exponent === 0 ? fraction * 2 ** -24 : exponent === 31 ? (fraction ? NaN : Infinity) : (fraction + 1024) * 2 ** (exponent - 25);
+                return [half & 0x8000 ? -value : value, offset];
+            }
+            if (info === 26) {
+                const buffer = Buffer.alloc(4);
+                buffer.writeUInt32BE(length);
+                return [buffer.readFloatBE(0), offset];
+            }
+            if (info === 27)
+                throw new WebAuthnError('Unsupported CBOR float.');
+            return [length, offset];
+        }
+    }
+}
+export const decodeCbor = (bytes) => decodeCborItem(bytes, 0)[0];
+// --- COSE keys (RFC 9053) and signatures.
+/** COSE algorithms supported: ES256, EdDSA (Ed25519), ES384, ES512, RS256. */
+export const SUPPORTED_ALGORITHMS = [-8, -7, -257, -35, -36];
+const EC_CURVES = { 1: 'P-256', 2: 'P-384', 3: 'P-521' };
+/** Public key of a COSE key map. */
+export function coseToPublicKey(cose) {
+    const kty = cose.get(1), algorithm = Number(cose.get(3));
+    if (!SUPPORTED_ALGORITHMS.includes(algorithm))
+        throw new WebAuthnError(`Unsupported key algorithm: ${algorithm}.`);
+    const bytes = (label) => { const value = cose.get(label); if (!Buffer.isBuffer(value))
+        throw new WebAuthnError('Invalid public key.'); return b64url(value); };
+    let jwk;
+    if (kty === 2 && [-7, -35, -36].includes(algorithm)) {
+        const curve = EC_CURVES[Number(cose.get(-1))];
+        if (!curve || curve !== { [-7]: 'P-256', [-35]: 'P-384', [-36]: 'P-521' }[algorithm])
+            throw new WebAuthnError('Invalid elliptic curve.');
+        jwk = { kty: 'EC', crv: curve, x: bytes(-2), y: bytes(-3) };
+    }
+    else if (kty === 1 && algorithm === -8) {
+        if (cose.get(-1) !== 6)
+            throw new WebAuthnError('Only the Ed25519 curve is supported for EdDSA.');
+        jwk = { kty: 'OKP', crv: 'Ed25519', x: bytes(-2) };
+    }
+    else if (kty === 3 && algorithm === -257) {
+        jwk = { kty: 'RSA', n: bytes(-1), e: bytes(-2) };
+    }
+    else
+        throw new WebAuthnError('Invalid public key type.');
+    try {
+        return { algorithm, key: createPublicKey({ key: jwk, format: 'jwk' }) };
+    }
+    catch {
+        throw new WebAuthnError('Invalid public key.');
+    }
+}
+/** Checks an assertion signature with a stored public key (SPKI DER, base64url). */
+export function verifySignature(algorithm, publicKey, data, signature) {
+    const key = createPublicKey({ key: fromB64url(publicKey, 'public key'), format: 'der', type: 'spki' });
+    try {
+        if (algorithm === -8)
+            return verify(null, data, key, signature);
+        if (algorithm === -7)
+            return verify('sha256', data, { key, dsaEncoding: 'der' }, signature);
+        if (algorithm === -35)
+            return verify('sha384', data, { key, dsaEncoding: 'der' }, signature);
+        if (algorithm === -36)
+            return verify('sha512', data, { key, dsaEncoding: 'der' }, signature);
+        if (algorithm === -257)
+            return verify('sha256', data, key, signature);
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+export function parseAuthenticatorData(data) {
+    if (data.length < 37)
+        throw new WebAuthnError('Authenticator data too short.');
+    const flags = data[32];
+    let offset = 37, attestedCredential = null;
+    if (flags & 0x40) {
+        if (data.length < offset + 18)
+            throw new WebAuthnError('Attested credential data too short.');
+        const aaguid = data.subarray(offset, offset + 16).toString('hex');
+        const idLength = data.readUInt16BE(offset + 16);
+        offset += 18;
+        if (idLength > 1023 || data.length < offset + idLength)
+            throw new WebAuthnError('Invalid credential id.');
+        const credentialId = Buffer.from(data.subarray(offset, offset + idLength));
+        offset += idLength;
+        const [publicKey, next] = decodeCborItem(data, offset);
+        if (!(publicKey instanceof Map))
+            throw new WebAuthnError('Invalid credential public key.');
+        offset = next;
+        attestedCredential = { aaguid: `${aaguid.slice(0, 8)}-${aaguid.slice(8, 12)}-${aaguid.slice(12, 16)}-${aaguid.slice(16, 20)}-${aaguid.slice(20)}`, credentialId, publicKey };
+    }
+    if (flags & 0x80)
+        offset = decodeCborItem(data, offset)[1]; // extensions
+    if (offset !== data.length)
+        throw new WebAuthnError('Unexpected data after the authenticator data.');
+    return { rpIdHash: data.subarray(0, 32), userPresent: Boolean(flags & 0x01), userVerified: Boolean(flags & 0x04), backupEligible: Boolean(flags & 0x08), backedUp: Boolean(flags & 0x10), signCount: data.readUInt32BE(33), attestedCredential };
+}
+const sameBytes = (a, b) => a.length === b.length && timingSafeEqual(a, b);
+function checkClientData(raw, type, expected) {
+    let clientData;
+    try {
+        clientData = JSON.parse(raw.toString('utf8'));
+    }
+    catch {
+        throw new WebAuthnError('Invalid client data.');
+    }
+    if (clientData?.type !== type)
+        throw new WebAuthnError('Unexpected ceremony type.');
+    if (typeof clientData.challenge !== 'string' || !sameBytes(fromB64url(clientData.challenge, 'challenge'), fromB64url(expected.challenge, 'challenge')))
+        throw new WebAuthnError('The challenge does not match.');
+    const origins = [expected.origin].flat();
+    if (!origins.includes(clientData.origin))
+        throw new WebAuthnError(`Unexpected origin: ${String(clientData.origin)}.`);
+    if (clientData.crossOrigin === true)
+        throw new WebAuthnError('Cross-origin ceremonies are not allowed.');
+}
+function checkAuthenticatorData(data, expected) {
+    if (!sameBytes(data.rpIdHash, createHash('sha256').update(expected.rpId).digest()))
+        throw new WebAuthnError('The relying party id does not match.');
+    if (!data.userPresent)
+        throw new WebAuthnError('The user was not present.');
+    if (expected.requireUserVerification && !data.userVerified)
+        throw new WebAuthnError('The user was not verified.');
+}
+/** Verifies a registration (`navigator.credentials.create()`), and returns the credential to store. Throws `WebAuthnError`. */
+export function verifyRegistration(response, expected) {
+    const body = response;
+    if (!body || typeof body !== 'object' || body.type !== 'public-key' || !body.response)
+        throw new WebAuthnError('Invalid credential.');
+    checkClientData(fromB64url(body.response.clientDataJSON, 'client data'), 'webauthn.create', expected);
+    const attestation = decodeCbor(fromB64url(body.response.attestationObject, 'attestation'));
+    if (!(attestation instanceof Map) || !Buffer.isBuffer(attestation.get('authData')))
+        throw new WebAuthnError('Invalid attestation object.');
+    const data = parseAuthenticatorData(attestation.get('authData'));
+    checkAuthenticatorData(data, expected);
+    if (!data.attestedCredential)
+        throw new WebAuthnError('No credential in the attestation.');
+    const credentialId = b64url(data.attestedCredential.credentialId);
+    if (credentialId !== b64url(fromB64url(body.rawId ?? body.id, 'credential id')))
+        throw new WebAuthnError('The credential id does not match.');
+    const { algorithm, key } = coseToPublicKey(data.attestedCredential.publicKey);
+    const transports = Array.isArray(body.response.transports) ? body.response.transports.filter((transport) => typeof transport === 'string' && /^[a-z-]{1,20}$/.test(transport)).slice(0, 10) : [];
+    return {
+        credentialId, publicKey: b64url(key.export({ type: 'spki', format: 'der' })), algorithm, signCount: data.signCount, transports,
+        aaguid: data.attestedCredential.aaguid, backedUp: data.backedUp, userVerified: data.userVerified,
+    };
+}
+/**
+ * Verifies an authentication (`navigator.credentials.get()`) against the stored credential whose id the response carries.
+ * Returns the new signature counter, to store. Throws `WebAuthnError`, notably when the counter went backwards (cloned key).
+ */
+export function verifyAuthentication(response, expected) {
+    const body = response;
+    if (!body || typeof body !== 'object' || body.type !== 'public-key' || !body.response)
+        throw new WebAuthnError('Invalid credential.');
+    if (b64url(fromB64url(body.rawId ?? body.id, 'credential id')) !== expected.credential.credentialId)
+        throw new WebAuthnError('Unknown credential.');
+    const clientDataJSON = fromB64url(body.response.clientDataJSON, 'client data');
+    checkClientData(clientDataJSON, 'webauthn.get', expected);
+    const authenticatorData = fromB64url(body.response.authenticatorData, 'authenticator data');
+    const data = parseAuthenticatorData(authenticatorData);
+    checkAuthenticatorData(data, expected);
+    const signed = Buffer.concat([authenticatorData, createHash('sha256').update(clientDataJSON).digest()]);
+    if (!verifySignature(expected.credential.algorithm, expected.credential.publicKey, signed, fromB64url(body.response.signature, 'signature')))
+        throw new WebAuthnError('Invalid signature.');
+    // A counter that does not increase means two copies of the key exist (§6.1.1); 0 means the authenticator keeps none.
+    if ((data.signCount !== 0 || expected.credential.signCount !== 0) && data.signCount <= expected.credential.signCount)
+        throw new WebAuthnError('The signature counter did not increase: this key may have been cloned.');
+    return { signCount: data.signCount, userVerified: data.userVerified };
+}
+/** Random challenge (base64url, 32 bytes). */
+export const generateChallenge = () => b64url(randomBytes(32));
+/** Options for `navigator.credentials.create()`, as JSON (`PublicKeyCredential.parseCreationOptionsFromJSON()`). */
+export function registrationOptions(options) {
+    return {
+        rp: { id: options.rpId, name: options.rpName },
+        user: { id: b64url(Buffer.from(options.userId)), name: options.userName, displayName: options.userDisplayName ?? options.userName },
+        challenge: options.challenge,
+        pubKeyCredParams: SUPPORTED_ALGORITHMS.map((alg) => ({ type: 'public-key', alg })),
+        timeout: options.timeout ?? 120_000,
+        excludeCredentials: (options.excludeCredentials ?? []).map((credential) => ({ type: 'public-key', id: credential.credentialId, ...(credential.transports?.length ? { transports: credential.transports } : {}) })),
+        authenticatorSelection: { residentKey: options.residentKey ?? 'discouraged', requireResidentKey: options.residentKey === 'required', userVerification: options.userVerification ?? 'preferred', ...(options.authenticatorAttachment ? { authenticatorAttachment: options.authenticatorAttachment } : {}) },
+        attestation: 'none',
+    };
+}
+/** Options for `navigator.credentials.get()`, as JSON (`PublicKeyCredential.parseRequestOptionsFromJSON()`). */
+export function authenticationOptions(options) {
+    return {
+        rpId: options.rpId,
+        challenge: options.challenge,
+        timeout: options.timeout ?? 120_000,
+        allowCredentials: (options.allowCredentials ?? []).map((credential) => ({ type: 'public-key', id: credential.credentialId, ...(credential.transports?.length ? { transports: credential.transports } : {}) })),
+        userVerification: options.userVerification ?? 'preferred',
+    };
+}

package/lib/xlsx.d.ts

@@ -0,0 +1,7 @@
+/** Workbook with a single sheet: the first row is bold (header). */
+export declare function buildXlsx(rows: unknown[][], sheetName?: string): Buffer;
+/**
+ * Rows of the first worksheet of an XLSX file, as text (numbers as written, booleans as `1`/`0`, formulas as their cached
+ * value). Stops after `maxRows` rows. Throws on a file that is not a valid workbook.
+ */
+export declare function readXlsx(archive: Buffer, maxRows?: number, maxEntryBytes?: number): string[][];