@renoxium/sdk 0.0.0-stage → 0.1.1

package/dist/totp.d.ts

@@ -0,0 +1,40 @@
+export type TotpAlgorithm = "SHA-1" | "SHA-256" | "SHA-512";
+export interface TotpOptions {
+    /** Seconds per step (RFC 6238 X); 30. */
+    period?: number;
+    /** Code length; 6 (8 for the RFC test vectors). */
+    digits?: number;
+    /** HMAC hash; SHA-1, what every authenticator app implements. */
+    algorithm?: TotpAlgorithm;
+}
+export interface VerifyOptions extends TotpOptions {
+    /** Unix seconds; now. */
+    time?: number;
+    /** Steps accepted before and after the current one; 1 (±30 s of clock drift). */
+    window?: number;
+    /**
+     * The step of the last code accepted for this secret: a code of that step
+     * or an earlier one is refused, so a code works once (RFC 6238 section 5.2).
+     */
+    lastStep?: number | null;
+}
+/** Base32 (RFC 4648) without padding. */
+export declare function base32Encode(bytes: Uint8Array): string;
+/** Base32 to bytes; spaces, dashes and lowercase are accepted, padding ignored. */
+export declare function base32Decode(text: string): Uint8Array;
+/** A random secret: `bytes` (20, 160 bits as RFC 4226 recommends) in base32. */
+export declare function generateTotpSecret(bytes?: number): string;
+/** The `otpauth://totp/...` URI an authenticator app scans (as a QR code). */
+export declare function totpUri(o: {
+    secret: string;
+    issuer: string;
+    account: string;
+} & TotpOptions): string;
+/** The code of `secret` (base32) at Unix second `time`, or of the raw key bytes. */
+export declare function totp(secret: string | Uint8Array, time?: number, o?: TotpOptions): Promise<string>;
+/**
+ * Checks `code` against the steps around `time`. Resolves with the matched
+ * step (store it as the next `lastStep`), or null when no step matches or
+ * the matched step is not after `lastStep` (a replay).
+ */
+export declare function verifyTotp(secret: string | Uint8Array, code: string, o?: VerifyOptions): Promise<number | null>;

package/dist/totp.js

@@ -0,0 +1,111 @@
+// TOTP (RFC 6238, over HOTP RFC 4226) for the `2fa` module (#287), the
+// `auth` module's step-up (#291) and control-plane MFA (#293); one
+// implementation, on Web Crypto (crypto.subtle), so it runs in an isolate,
+// in Bun and in a browser alike (#284).
+//
+//   const secret = generateTotpSecret();                       // base32, 160 bits
+//   const uri = totpUri({ secret, issuer: "Shop", account: "alice@example.com" });
+//   const step = await verifyTotp(secret, "123456", { lastStep }); // null, or the step to store
+import { timingSafeEqual } from "./crypto.js";
+/** Web Crypto takes ArrayBuffer-backed views; ours always are. */
+const buf = (u) => u;
+/** RFC 4648 base32 alphabet (no padding in the secret). */
+const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+/** Base32 (RFC 4648) without padding. */
+export function base32Encode(bytes) {
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const b of bytes) {
+        value = (value << 8) | b;
+        bits += 8;
+        while (bits >= 5) {
+            out += B32[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += B32[(value << (5 - bits)) & 31];
+    return out;
+}
+/** Base32 to bytes; spaces, dashes and lowercase are accepted, padding ignored. */
+export function base32Decode(text) {
+    const clean = text.toUpperCase().replace(/[\s=-]/gu, "");
+    const out = [];
+    let bits = 0;
+    let value = 0;
+    for (const c of clean) {
+        const v = B32.indexOf(c);
+        if (v < 0)
+            throw new TypeError(`base32: invalid character ${JSON.stringify(c)}`);
+        value = (value << 5) | v;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return new Uint8Array(out);
+}
+/** A random secret: `bytes` (20, 160 bits as RFC 4226 recommends) in base32. */
+export function generateTotpSecret(bytes = 20) {
+    return base32Encode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+/** The `otpauth://totp/...` URI an authenticator app scans (as a QR code). */
+export function totpUri(o) {
+    const label = `${encodeURIComponent(o.issuer)}:${encodeURIComponent(o.account)}`;
+    const q = new URLSearchParams({ secret: o.secret, issuer: o.issuer });
+    if (o.algorithm && o.algorithm !== "SHA-1")
+        q.set("algorithm", o.algorithm.replace("-", ""));
+    if (o.digits && o.digits !== 6)
+        q.set("digits", String(o.digits));
+    if (o.period && o.period !== 30)
+        q.set("period", String(o.period));
+    return `otpauth://totp/${label}?${q.toString()}`;
+}
+/** HOTP (RFC 4226) of `counter` with the raw key. */
+async function hotp(key, counter, digits, algorithm) {
+    const msg = new Uint8Array(8);
+    const view = new DataView(msg.buffer);
+    view.setUint32(0, Math.floor(counter / 2 ** 32));
+    view.setUint32(4, counter >>> 0);
+    const k = await crypto.subtle.importKey("raw", buf(key), { name: "HMAC", hash: algorithm }, false, ["sign"]);
+    const mac = new Uint8Array(await crypto.subtle.sign("HMAC", k, buf(msg)));
+    const offset = mac[mac.length - 1] & 0x0f;
+    const bin = ((mac[offset] & 0x7f) << 24) | (mac[offset + 1] << 16) | (mac[offset + 2] << 8) | mac[offset + 3];
+    return String(bin % 10 ** digits).padStart(digits, "0");
+}
+/** The code of `secret` (base32) at Unix second `time`, or of the raw key bytes. */
+export async function totp(secret, time = Date.now() / 1000, o = {}) {
+    const key = typeof secret === "string" ? base32Decode(secret) : secret;
+    const step = Math.floor(time / (o.period ?? 30));
+    return hotp(key, step, o.digits ?? 6, o.algorithm ?? "SHA-1");
+}
+/** Constant-time comparison of two digit strings (crypto.ts). */
+const same = (a, b) => timingSafeEqual(a, b);
+/**
+ * Checks `code` against the steps around `time`. Resolves with the matched
+ * step (store it as the next `lastStep`), or null when no step matches or
+ * the matched step is not after `lastStep` (a replay).
+ */
+export async function verifyTotp(secret, code, o = {}) {
+    const digits = o.digits ?? 6;
+    if (typeof code !== "string" || !new RegExp(`^[0-9]{${digits}}$`, "u").test(code.trim()))
+        return null;
+    const key = typeof secret === "string" ? base32Decode(secret) : secret;
+    const period = o.period ?? 30;
+    const now = Math.floor((o.time ?? Date.now() / 1000) / period);
+    const window = Math.max(0, Math.min(o.window ?? 1, 10));
+    let found = null;
+    // Every candidate is computed, so the time taken does not say which matched.
+    for (let s = now - window; s <= now + window; s++) {
+        const ok = same(await hotp(key, s, digits, o.algorithm ?? "SHA-1"), code.trim());
+        if (ok && found === null)
+            found = s;
+    }
+    if (found === null)
+        return null;
+    if (o.lastStep !== undefined && o.lastStep !== null && found <= o.lastStep)
+        return null;
+    return found;
+}

package/dist/validate.d.ts

@@ -0,0 +1,76 @@
+/** The Standard Schema v1 interface (`@standard-schema/spec` 1.0.0). */
+export interface StandardSchemaV1<Input = unknown, Output = Input> {
+    readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+export declare namespace StandardSchemaV1 {
+    interface Props<Input = unknown, Output = Input> {
+        readonly version: 1;
+        readonly vendor: string;
+        readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
+        readonly types?: Types<Input, Output> | undefined;
+    }
+    type Result<Output> = SuccessResult<Output> | FailureResult;
+    interface SuccessResult<Output> {
+        readonly value: Output;
+        readonly issues?: undefined;
+    }
+    interface FailureResult {
+        readonly issues: ReadonlyArray<Issue>;
+    }
+    interface Issue {
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+    }
+    interface PathSegment {
+        readonly key: PropertyKey;
+    }
+    interface Types<Input = unknown, Output = Input> {
+        readonly input: Input;
+        readonly output: Output;
+    }
+    type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+    type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** One validation failure: the schema's message and the path to the value, `[]` for the root. */
+export interface ValidationIssue {
+    readonly message: string;
+    readonly path: readonly (string | number)[];
+}
+/**
+ * Thrown by `validate()` when the input does not match the schema, or when a
+ * `Request` body cannot be read as JSON or a form. Not a `RenoxError`: no
+ * platform code, it is the tenant's own 400. `toResponse()` builds one.
+ */
+export declare class ValidationError extends Error {
+    readonly name = "ValidationError";
+    readonly issues: readonly ValidationIssue[];
+    constructor(issues: readonly ValidationIssue[]);
+    /** `400` with `{ "issues": [{ "message", "path" }] }`. */
+    toResponse(init?: ResponseInit): Response;
+}
+/** What `validate()` reads: a request body, a parsed form, query parameters, or a plain value. */
+export type ValidateInput = Request | FormData | URLSearchParams | unknown;
+/**
+ * A form or query string as an object: a key seen once maps to its value
+ * (`string`, or `File` for an upload), a repeated key to the array of its
+ * values in order.
+ */
+export declare function formToObject(form: FormData | URLSearchParams): Record<string, FormDataEntryValue | FormDataEntryValue[]>;
+/**
+ * Validates `input` against a Standard Schema and returns the schema's
+ * output (with its transforms and defaults applied).
+ *
+ * - `Request`: the body, read once as JSON (`application/json`, `+json`) or
+ *   as a form (urlencoded, multipart); any other content type fails.
+ * - `FormData`, `URLSearchParams` (`ctx.form` in an action,
+ *   `ctx.url.searchParams`): converted with `formToObject`.
+ * - Anything else is validated as is.
+ *
+ * Throws `ValidationError` on failure.
+ *
+ * ```ts
+ * const order = await validate(req, OrderSchema);          // POST handler
+ * const input = await validate(form, AddToCartSchema);     // action
+ * ```
+ */
+export declare function validate<S extends StandardSchemaV1>(input: ValidateInput, schema: S): Promise<StandardSchemaV1.InferOutput<S>>;

package/dist/validate.js

@@ -0,0 +1,105 @@
+// `validate(input, Schema)`: input validation before the handler body
+// (docs/04-isolation-security.md, "Input validation"). Any schema library
+// that implements Standard Schema v1 (https://standardschema.dev) works:
+// zod (3.24+), valibot (1.0+), arktype, effect. The SDK depends on none of
+// them: the interface below is the spec's, copied as the spec recommends.
+/**
+ * Thrown by `validate()` when the input does not match the schema, or when a
+ * `Request` body cannot be read as JSON or a form. Not a `RenoxError`: no
+ * platform code, it is the tenant's own 400. `toResponse()` builds one.
+ */
+export class ValidationError extends Error {
+    name = "ValidationError";
+    issues;
+    constructor(issues) {
+        const first = issues[0];
+        super(first
+            ? `validation failed: ${first.path.length ? `${first.path.join(".")}: ` : ""}${first.message}${issues.length > 1 ? ` (and ${issues.length - 1} more)` : ""}`
+            : "validation failed");
+        this.issues = Object.freeze([...issues]);
+    }
+    /** `400` with `{ "issues": [{ "message", "path" }] }`. */
+    toResponse(init) {
+        return Response.json({ issues: this.issues }, { status: 400, ...init });
+    }
+}
+/**
+ * A form or query string as an object: a key seen once maps to its value
+ * (`string`, or `File` for an upload), a repeated key to the array of its
+ * values in order.
+ */
+export function formToObject(form) {
+    const out = Object.create(null);
+    for (const [key, value] of form) {
+        const prev = out[key];
+        if (prev === undefined)
+            out[key] = value;
+        else if (Array.isArray(prev))
+            prev.push(value);
+        else
+            out[key] = [prev, value];
+    }
+    return out;
+}
+const fail = (message) => new ValidationError([{ message, path: [] }]);
+/** The value a `Request` body stands for: JSON, or a form as `formToObject` builds it. */
+async function readBody(req) {
+    const type = (req.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+    if (type === "application/json" || type.endsWith("+json")) {
+        const text = await req.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw fail("request body is not valid JSON");
+        }
+    }
+    if (type === "application/x-www-form-urlencoded" || type === "multipart/form-data") {
+        let form;
+        try {
+            form = await req.formData();
+        }
+        catch {
+            throw fail("request body is not a valid form");
+        }
+        return formToObject(form);
+    }
+    throw fail(`unsupported content type ${type ? JSON.stringify(type) : "(none)"}: expected JSON or a form`);
+}
+function pathOf(path) {
+    return (path ?? []).map((seg) => {
+        const key = typeof seg === "object" && seg !== null ? seg.key : seg;
+        return typeof key === "number" ? key : String(key);
+    });
+}
+/**
+ * Validates `input` against a Standard Schema and returns the schema's
+ * output (with its transforms and defaults applied).
+ *
+ * - `Request`: the body, read once as JSON (`application/json`, `+json`) or
+ *   as a form (urlencoded, multipart); any other content type fails.
+ * - `FormData`, `URLSearchParams` (`ctx.form` in an action,
+ *   `ctx.url.searchParams`): converted with `formToObject`.
+ * - Anything else is validated as is.
+ *
+ * Throws `ValidationError` on failure.
+ *
+ * ```ts
+ * const order = await validate(req, OrderSchema);          // POST handler
+ * const input = await validate(form, AddToCartSchema);     // action
+ * ```
+ */
+export async function validate(input, schema) {
+    const std = schema?.["~standard"];
+    if (!std || std.version !== 1 || typeof std.validate !== "function")
+        throw new TypeError("validate(): the schema does not implement Standard Schema v1 (zod 3.24+, valibot 1.0+)");
+    let value = input;
+    if (input instanceof Request)
+        value = await readBody(input);
+    else if (input instanceof FormData || input instanceof URLSearchParams)
+        value = formToObject(input);
+    const result = await std.validate(value);
+    if (result.issues)
+        throw new ValidationError(result.issues.map((i) => ({ message: i.message, path: pathOf(i.path) })));
+    return result.value;
+}

package/dist/webauthn.d.ts

@@ -0,0 +1,63 @@
+/** Why a registration or an assertion was refused. */
+export declare class WebAuthnError extends Error {
+    readonly reason: "client_data" | "type" | "challenge" | "origin" | "rp_id" | "user_presence" | "user_verification" | "credential" | "attestation" | "algorithm" | "signature" | "counter";
+    readonly name = "WebAuthnError";
+    constructor(reason: "client_data" | "type" | "challenge" | "origin" | "rp_id" | "user_presence" | "user_verification" | "credential" | "attestation" | "algorithm" | "signature" | "counter", message: string);
+}
+export type Binary = string | ArrayBuffer | Uint8Array;
+/** base64url without padding. */
+export declare function base64url(bytes: Uint8Array): string;
+/** base64url (or base64) to bytes. */
+export declare function fromBase64url(text: string): Uint8Array;
+type Cbor = number | bigint | string | Uint8Array | boolean | null | undefined | Cbor[] | Map<Cbor, Cbor>;
+/** Decodes one CBOR item at `at`; returns it and the offset after it. */
+export declare function decodeCbor(b: Uint8Array, at?: number): [Cbor, number];
+export declare const COSE_ES256 = -7;
+export declare const COSE_RS256 = -257;
+interface Expected {
+    /** The challenge the server issued, base64url. */
+    expectedChallenge: string;
+    /** The page origin(s) the ceremony may come from (`https://shop.example`). */
+    expectedOrigin: string | readonly string[];
+    /** The relying party id (the host, or a registrable suffix of it). */
+    expectedRpId: string;
+    /** Require the UV flag (a PIN or biometric, not only presence). */
+    requireUserVerification?: boolean;
+}
+/** What to store for a new credential. */
+export interface RegisteredCredential {
+    /** base64url; the `id` the browser sends back in assertions. */
+    credentialId: string;
+    /** The COSE public key, base64url. */
+    publicKey: string;
+    /** -7 (ES256) or -257 (RS256). */
+    algorithm: number;
+    counter: number;
+    userVerified: boolean;
+    attestationFormat: string;
+}
+/** Verifies `navigator.credentials.create()`'s response. */
+export declare function verifyRegistration(o: Expected & {
+    response: {
+        clientDataJSON: Binary;
+        attestationObject: Binary;
+    };
+}): Promise<RegisteredCredential>;
+/** Verifies `navigator.credentials.get()`'s response against a stored credential; resolves with the counter to store. */
+export declare function verifyAssertion(o: Expected & {
+    response: {
+        clientDataJSON: Binary;
+        authenticatorData: Binary;
+        signature: Binary;
+    };
+    credential: {
+        publicKey: string;
+        counter: number;
+    };
+}): Promise<{
+    counter: number;
+    userVerified: boolean;
+}>;
+/** A random challenge (32 bytes, base64url) for a ceremony; store it with the session. */
+export declare function webauthnChallenge(): string;
+export {};

package/dist/webauthn.js

@@ -0,0 +1,283 @@
+// WebAuthn verification (W3C Web Authentication Level 2) for passkeys: the
+// `2fa` module (#287), the `auth` passkey sign-in (#291) and control-plane
+// MFA (#293). One implementation on Web Crypto (#284).
+//
+// Registration (`navigator.credentials.create`): the client data's type,
+// challenge and origin, the RP id hash, the user-present (and, when asked,
+// user-verified) flags, the attested credential, and the attestation
+// statement of the `none` and `packed` self-attestation formats (formats
+// with a certificate chain are refused: there is no trust store here).
+// Assertion (`navigator.credentials.get`): the same checks, the signature
+// over authenticatorData || SHA-256(clientDataJSON) with the stored COSE
+// key (ES256 or RS256), and the signature counter, which must grow unless
+// both are 0 (a counter that does not grow means a cloned authenticator).
+//
+// Binary values cross as base64url strings, as the browser JSON
+// serialisation (PublicKeyCredential.toJSON) gives them.
+import { timingSafeEqual } from "./crypto.js";
+const enc = new TextEncoder();
+/** Web Crypto takes ArrayBuffer-backed views; ours always are. */
+const buf = (u) => u;
+const dec = new TextDecoder();
+/** Why a registration or an assertion was refused. */
+export class WebAuthnError extends Error {
+    reason;
+    name = "WebAuthnError";
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
+/** base64url without padding. */
+export function base64url(bytes) {
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+}
+/** base64url (or base64) to bytes. */
+export function fromBase64url(text) {
+    const b64 = text.replace(/-/gu, "+").replace(/_/gu, "/");
+    const bin = atob(b64 + "===".slice((b64.length + 3) % 4));
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+const bytesOf = (v) => (typeof v === "string" ? fromBase64url(v) : v instanceof Uint8Array ? v : new Uint8Array(v));
+async function sha256(b) {
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", buf(b)));
+}
+/** Constant time (crypto.ts): challenges and RP id hashes are secrets of the ceremony. */
+const equal = (a, b) => timingSafeEqual(a, b);
+/** Decodes one CBOR item at `at`; returns it and the offset after it. */
+export function decodeCbor(b, at = 0) {
+    const head = b[at];
+    if (head === undefined)
+        throw new WebAuthnError("credential", "CBOR: truncated");
+    const major = head >> 5;
+    const info = head & 31;
+    let i = at + 1;
+    let n;
+    if (info < 24)
+        n = info;
+    else if (info === 24)
+        n = b[i++];
+    else if (info === 25) {
+        n = (b[i] << 8) | b[i + 1];
+        i += 2;
+    }
+    else if (info === 26) {
+        n = new DataView(b.buffer, b.byteOffset + i, 4).getUint32(0);
+        i += 4;
+    }
+    else if (info === 27) {
+        const big = new DataView(b.buffer, b.byteOffset + i, 8).getBigUint64(0);
+        n = Number(big);
+        i += 8;
+    }
+    else
+        throw new WebAuthnError("credential", "CBOR: indefinite lengths are not supported");
+    switch (major) {
+        case 0:
+            return [n, i];
+        case 1:
+            return [-1 - n, i];
+        case 2:
+            if (i + n > b.length)
+                throw new WebAuthnError("credential", "CBOR: truncated byte string");
+            return [b.slice(i, i + n), i + n];
+        case 3:
+            if (i + n > b.length)
+                throw new WebAuthnError("credential", "CBOR: truncated text");
+            return [dec.decode(b.subarray(i, i + n)), i + n];
+        case 4: {
+            const arr = [];
+            for (let k = 0; k < n; k++) {
+                const [v, next] = decodeCbor(b, i);
+                arr.push(v);
+                i = next;
+            }
+            return [arr, i];
+        }
+        case 5: {
+            const map = new Map();
+            for (let k = 0; k < n; k++) {
+                const [key, a] = decodeCbor(b, i);
+                const [v, next] = decodeCbor(b, a);
+                map.set(key, v);
+                i = next;
+            }
+            return [map, i];
+        }
+        case 7:
+            if (info === 20)
+                return [false, i];
+            if (info === 21)
+                return [true, i];
+            if (info === 22)
+                return [null, i];
+            return [undefined, i];
+        default:
+            throw new WebAuthnError("credential", `CBOR: major type ${major} is not supported`);
+    }
+}
+// --- COSE keys (RFC 9053): ES256 and RS256 ------------------------------------
+export const COSE_ES256 = -7;
+export const COSE_RS256 = -257;
+async function importCose(cose) {
+    const [m] = decodeCbor(cose);
+    if (!(m instanceof Map))
+        throw new WebAuthnError("credential", "the credential public key is not a COSE map");
+    const kty = m.get(1);
+    const alg = m.get(3);
+    if (kty === 2 && alg === COSE_ES256 && m.get(-1) === 1) {
+        const x = m.get(-2);
+        const y = m.get(-3);
+        if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array) || x.length !== 32 || y.length !== 32)
+            throw new WebAuthnError("credential", "ES256 key: bad coordinates");
+        const key = await crypto.subtle.importKey("jwk", { kty: "EC", crv: "P-256", x: base64url(x), y: base64url(y), ext: true }, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+        return { key, alg };
+    }
+    if (kty === 3 && alg === COSE_RS256) {
+        const n = m.get(-1);
+        const e = m.get(-2);
+        if (!(n instanceof Uint8Array) || !(e instanceof Uint8Array) || n.length < 256)
+            throw new WebAuthnError("credential", "RS256 key: bad modulus or exponent");
+        const key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: base64url(n), e: base64url(e), alg: "RS256", ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+        return { key, alg };
+    }
+    throw new WebAuthnError("algorithm", `unsupported COSE key (kty ${String(kty)}, alg ${String(alg)}); ES256 and RS256 are accepted`);
+}
+/** An ECDSA DER signature (WebAuthn's) to the raw r || s Web Crypto takes. */
+function derToRaw(der, size = 32) {
+    if (der[0] !== 0x30)
+        throw new WebAuthnError("signature", "ES256 signature is not DER");
+    let i = 2;
+    const int = () => {
+        if (der[i] !== 0x02)
+            throw new WebAuthnError("signature", "ES256 signature is not DER");
+        const len = der[i + 1];
+        let v = der.subarray(i + 2, i + 2 + len);
+        i += 2 + len;
+        while (v.length > size && v[0] === 0)
+            v = v.subarray(1);
+        if (v.length > size)
+            throw new WebAuthnError("signature", "ES256 signature integer too long");
+        const out = new Uint8Array(size);
+        out.set(v, size - v.length);
+        return out;
+    };
+    const r = int();
+    const s = int();
+    const raw = new Uint8Array(size * 2);
+    raw.set(r);
+    raw.set(s, size);
+    return raw;
+}
+async function verifySignature(cose, signature, data) {
+    const { key, alg } = await importCose(cose);
+    if (alg === COSE_ES256)
+        return crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, buf(derToRaw(signature)), buf(data));
+    return crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, buf(signature), buf(data));
+}
+function parseAuthData(b) {
+    if (b.length < 37)
+        throw new WebAuthnError("credential", "authenticator data is too short");
+    const flags = b[32];
+    const out = {
+        rpIdHash: b.slice(0, 32),
+        userPresent: (flags & 0x01) !== 0,
+        userVerified: (flags & 0x04) !== 0,
+        counter: new DataView(b.buffer, b.byteOffset + 33, 4).getUint32(0),
+    };
+    if (flags & 0x40) {
+        // Attested credential data: aaguid (16), credentialIdLength (2), id, COSE key.
+        const len = (b[53] << 8) | b[54];
+        out.credentialId = b.slice(55, 55 + len);
+        const [, end] = decodeCbor(b, 55 + len);
+        out.publicKey = b.slice(55 + len, end);
+    }
+    return out;
+}
+async function checkClientData(raw, type, o) {
+    let c;
+    try {
+        c = JSON.parse(dec.decode(raw));
+    }
+    catch {
+        throw new WebAuthnError("client_data", "clientDataJSON is not JSON");
+    }
+    if (c.type !== type)
+        throw new WebAuthnError("type", `clientData.type is ${String(c.type)}, expected ${type}`);
+    if (typeof c.challenge !== "string" || !equal(fromBase64url(c.challenge), fromBase64url(o.expectedChallenge))) {
+        throw new WebAuthnError("challenge", "the challenge does not match");
+    }
+    const origins = typeof o.expectedOrigin === "string" ? [o.expectedOrigin] : o.expectedOrigin;
+    if (typeof c.origin !== "string" || !origins.includes(c.origin))
+        throw new WebAuthnError("origin", `origin ${String(c.origin)} is not expected`);
+}
+async function checkAuthData(a, o) {
+    if (!equal(a.rpIdHash, await sha256(enc.encode(o.expectedRpId))))
+        throw new WebAuthnError("rp_id", "the RP id hash does not match");
+    if (!a.userPresent)
+        throw new WebAuthnError("user_presence", "the user was not present");
+    if (o.requireUserVerification && !a.userVerified)
+        throw new WebAuthnError("user_verification", "the user was not verified");
+}
+/** Verifies `navigator.credentials.create()`'s response. */
+export async function verifyRegistration(o) {
+    const clientData = bytesOf(o.response.clientDataJSON);
+    await checkClientData(clientData, "webauthn.create", o);
+    const [att] = decodeCbor(bytesOf(o.response.attestationObject));
+    if (!(att instanceof Map))
+        throw new WebAuthnError("attestation", "attestationObject is not a CBOR map");
+    const fmt = att.get("fmt");
+    const authBytes = att.get("authData");
+    const stmt = att.get("attStmt");
+    if (typeof fmt !== "string" || !(authBytes instanceof Uint8Array) || !(stmt instanceof Map))
+        throw new WebAuthnError("attestation", "attestationObject lacks fmt, authData or attStmt");
+    const auth = parseAuthData(authBytes);
+    await checkAuthData(auth, o);
+    if (!auth.credentialId || !auth.publicKey)
+        throw new WebAuthnError("credential", "no attested credential data");
+    const { alg } = await importCose(auth.publicKey);
+    if (fmt === "packed") {
+        if (stmt.has("x5c"))
+            throw new WebAuthnError("attestation", "packed attestation with a certificate chain is not supported");
+        const sig = stmt.get("sig");
+        if (stmt.get("alg") !== alg || !(sig instanceof Uint8Array))
+            throw new WebAuthnError("attestation", "packed self attestation: alg or sig");
+        const data = new Uint8Array([...authBytes, ...(await sha256(clientData))]);
+        if (!(await verifySignature(auth.publicKey, sig, data)))
+            throw new WebAuthnError("signature", "the attestation signature does not verify");
+    }
+    else if (fmt !== "none") {
+        throw new WebAuthnError("attestation", `attestation format ${fmt} is not supported (none and packed self attestation are)`);
+    }
+    return {
+        credentialId: base64url(auth.credentialId),
+        publicKey: base64url(auth.publicKey),
+        algorithm: alg,
+        counter: auth.counter,
+        userVerified: auth.userVerified,
+        attestationFormat: fmt,
+    };
+}
+/** Verifies `navigator.credentials.get()`'s response against a stored credential; resolves with the counter to store. */
+export async function verifyAssertion(o) {
+    const clientData = bytesOf(o.response.clientDataJSON);
+    await checkClientData(clientData, "webauthn.get", o);
+    const authBytes = bytesOf(o.response.authenticatorData);
+    const auth = parseAuthData(authBytes);
+    await checkAuthData(auth, o);
+    const data = new Uint8Array([...authBytes, ...(await sha256(clientData))]);
+    if (!(await verifySignature(fromBase64url(o.credential.publicKey), bytesOf(o.response.signature), data))) {
+        throw new WebAuthnError("signature", "the assertion signature does not verify");
+    }
+    if ((auth.counter !== 0 || o.credential.counter !== 0) && auth.counter <= o.credential.counter) {
+        throw new WebAuthnError("counter", `the signature counter did not grow (${auth.counter} after ${o.credential.counter}): a replay or a cloned authenticator`);
+    }
+    return { counter: auth.counter, userVerified: auth.userVerified };
+}
+/** A random challenge (32 bytes, base64url) for a ceremony; store it with the session. */
+export function webauthnChallenge() {
+    return base64url(crypto.getRandomValues(new Uint8Array(32)));
+}