nid-webauthn-emulator 0.1.3

package/dist/spec/webauthn/webauthn-test-server.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthnTestServer = exports.TEST_RP_ID = exports.TEST_RP_ORIGIN = void 0;
+const server_1 = require("@simplewebauthn/server");
+exports.TEST_RP_ORIGIN = "https://test-rp.com";
+exports.TEST_RP_ID = "test-rp.com";
+class WebAuthnTestServer {
+    origin;
+    rpID;
+    challenges = new Set();
+    credentials = [];
+    constructor(origin = exports.TEST_RP_ORIGIN, rpID = exports.TEST_RP_ID) {
+        this.origin = origin;
+        this.rpID = rpID;
+    }
+    async getRegistrationOptions(user) {
+        const options = await (0, server_1.generateRegistrationOptions)({
+            rpName: "Test RP",
+            rpID: this.rpID,
+            userName: user.username,
+            attestationType: "none",
+            excludeCredentials: this.credentials.map((cred) => ({
+                id: cred.id,
+                type: "public-key",
+            })),
+            authenticatorSelection: {
+                residentKey: "preferred",
+                userVerification: "preferred",
+                authenticatorAttachment: "platform",
+            },
+        });
+        options.user.id;
+        this.challenges.add(options.challenge);
+        return options;
+    }
+    async getRegistrationVerification(user, response) {
+        const verification = await (0, server_1.verifyRegistrationResponse)({
+            response,
+            expectedChallenge: (challenge) => this.challenges.has(challenge),
+            expectedOrigin: this.origin,
+            expectedRPID: this.rpID,
+        });
+        if (!verification.verified || !verification.registrationInfo)
+            throw new Error("Registration verification failed");
+        const registrationInfo = verification.registrationInfo;
+        this.credentials.push({
+            id: response.id,
+            publicKey: registrationInfo.credentialPublicKey,
+            user,
+            webauthnUserID: user.id,
+            counter: verification.registrationInfo.counter,
+            backedUp: false,
+            transports: undefined,
+        });
+    }
+    async getAuthenticationOptions() {
+        const options = await (0, server_1.generateAuthenticationOptions)({
+            rpID: this.rpID,
+            allowCredentials: this.credentials.map((cred) => ({
+                id: cred.id,
+                type: "public-key",
+            })),
+        });
+        this.challenges.add(options.challenge);
+        return options;
+    }
+    async getAuthenticationVerification(response) {
+        const credential = this.credentials.find((cred) => cred.id === response.id);
+        if (!credential)
+            throw new Error("Credential not found");
+        const verification = await (0, server_1.verifyAuthenticationResponse)({
+            response,
+            expectedChallenge: (challenge) => this.challenges.has(challenge),
+            expectedOrigin: this.origin,
+            expectedRPID: this.rpID,
+            authenticator: {
+                credentialID: credential.id,
+                credentialPublicKey: credential.publicKey,
+                counter: credential.counter,
+                transports: credential.transports,
+            },
+        });
+        if (!verification.verified)
+            throw new Error("Authentication verification failed");
+    }
+}
+exports.WebAuthnTestServer = WebAuthnTestServer;

package/dist/src/authenticator/authenticator-emulator.d.ts

@@ -0,0 +1,68 @@
+import type { PasskeysCredentialsRepository } from "../repository/credentials-repository";
+import { type AuthenticatorData, type PublicKeyCredentialSource } from "../webauthn/webauthn-model";
+import { type AuthenticatorGetAssertionRequest, type AuthenticatorGetAssertionResponse, type AuthenticatorGetInfoResponse, type AuthenticatorMakeCredentialRequest, type AuthenticatorMakeCredentialResponse, type AuthenticatorOptions, type CTAPAuthenticatorRequest, type CTAPAuthenticatorResponse } from "./ctap-model";
+type InteractionResponse = {
+    options: {
+        uv: boolean;
+        up: boolean;
+    };
+};
+export declare const COSEAlgorithmIdentifier: {
+    ES256: number;
+    RS256: number;
+    EdDSA: number;
+};
+export type PasskeyCredential = {
+    readonly publicKeyCredentialDescriptor: PublicKeyCredentialDescriptor;
+    readonly publicKeyCredentialSource: PublicKeyCredentialSource;
+    readonly authenticatorData: AuthenticatorData;
+    readonly user: PublicKeyCredentialUserEntity | undefined;
+};
+export type AuthenticatorParameters = {
+    readonly aaguid: Uint8Array;
+    readonly transports: AuthenticatorTransport[];
+    readonly algorithmIdentifiers: readonly (keyof typeof COSEAlgorithmIdentifier)[];
+    readonly signCounterIncrement: number;
+    readonly verifications: {
+        readonly userPresent: boolean;
+        readonly userVerified: boolean;
+    };
+    readonly userMakeCredentialInteraction: (user: PublicKeyCredentialUserEntity, options?: Partial<AuthenticatorOptions>) => InteractionResponse | undefined;
+    readonly userGetAssertionInteraction: (user: PublicKeyCredentialUserEntity | undefined, options?: Partial<AuthenticatorOptions>) => InteractionResponse | undefined;
+    readonly credentialsRepository: PasskeysCredentialsRepository | undefined;
+    readonly stateless: boolean;
+};
+export type MakeCredentialInteraction = (user: PublicKeyCredentialUserEntity, uv: boolean) => boolean;
+/**
+ * Authenticator emulator
+ */
+export declare class AuthenticatorEmulator {
+    private static readonly ENCRYPT_KEY;
+    /** Authenticator Attestation Global Unique Identifier (16byte)  */
+    private static readonly DEFAULT_AAGUID;
+    private static readonly DEFAULT_TRANSPORTS;
+    private static readonly DEFAULT_ALGORITHM_IDENTIFIERS;
+    private static readonly DEFAULT_SIGN_COUNTER_INCREMENT;
+    private static readonly DEFAULT_VERIFICATIONS;
+    private static readonly DEFAULT_MAKE_CREDENTIAL_INTERACTION;
+    private static readonly DEFAULT_GET_ASSERTION_INTERACTION;
+    private static readonly DEFAULT_CREDENTIALS_REPOSITORY;
+    private static readonly DEFAULT_STATELESS;
+    params: AuthenticatorParameters;
+    constructor(params?: Partial<AuthenticatorParameters>);
+    /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticator-api */
+    command(request: CTAPAuthenticatorRequest): CTAPAuthenticatorResponse;
+    /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfo */
+    authenticatorGetInfo(): AuthenticatorGetInfoResponse;
+    /**
+     * @see https://www.w3.org/TR/webauthn/#sctn-op-make-cred
+     * @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential
+     **/
+    authenticatorMakeCredential(request: AuthenticatorMakeCredentialRequest): AuthenticatorMakeCredentialResponse;
+    /**
+     * @see https://www.w3.org/TR/webauthn/#sctn-op-get-assertion
+     * @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion
+     **/
+    authenticatorGetAssertion(request: AuthenticatorGetAssertionRequest): AuthenticatorGetAssertionResponse;
+}
+export {};

package/dist/src/authenticator/authenticator-emulator.js

@@ -0,0 +1,304 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticatorEmulator = exports.COSEAlgorithmIdentifier = void 0;
+const node_crypto_1 = require("node:crypto");
+const encode_utils_1 = __importDefault(require("../libs/encode-utils"));
+const credentials_memory_repository_1 = require("../repository/credentials-memory-repository");
+const cose_key_1 = require("../webauthn/cose-key");
+const webauthn_model_1 = require("../webauthn/webauthn-model");
+const ctap_model_1 = require("./ctap-model");
+exports.COSEAlgorithmIdentifier = {
+    ES256: -7,
+    RS256: -257,
+    EdDSA: -8,
+};
+/**
+ * Authenticator emulator
+ */
+class AuthenticatorEmulator {
+    static ENCRYPT_KEY = encode_utils_1.default.strToUint8Array("NID-AUTH-31415926535897932384626");
+    /** Authenticator Attestation Global Unique Identifier (16byte)  */
+    static DEFAULT_AAGUID = encode_utils_1.default.strToUint8Array("NID-AUTH-3141592");
+    static DEFAULT_TRANSPORTS = ["usb"];
+    static DEFAULT_ALGORITHM_IDENTIFIERS = ["ES256", "RS256", "EdDSA"];
+    static DEFAULT_SIGN_COUNTER_INCREMENT = 1;
+    static DEFAULT_VERIFICATIONS = { userPresent: true, userVerified: true };
+    static DEFAULT_MAKE_CREDENTIAL_INTERACTION = (user) => ({
+        user: user,
+        options: { uv: true, up: true },
+    });
+    static DEFAULT_GET_ASSERTION_INTERACTION = (user) => ({
+        user: user,
+        options: { uv: true, up: true },
+    });
+    static DEFAULT_CREDENTIALS_REPOSITORY = new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository();
+    static DEFAULT_STATELESS = false;
+    params;
+    constructor(params = {}) {
+        this.params = {
+            aaguid: params.aaguid ?? AuthenticatorEmulator.DEFAULT_AAGUID,
+            transports: params.transports ?? AuthenticatorEmulator.DEFAULT_TRANSPORTS,
+            algorithmIdentifiers: params.algorithmIdentifiers ?? AuthenticatorEmulator.DEFAULT_ALGORITHM_IDENTIFIERS,
+            signCounterIncrement: params.stateless
+                ? 0
+                : params.signCounterIncrement ?? AuthenticatorEmulator.DEFAULT_SIGN_COUNTER_INCREMENT,
+            verifications: params.verifications ?? AuthenticatorEmulator.DEFAULT_VERIFICATIONS,
+            userMakeCredentialInteraction: params.userMakeCredentialInteraction ?? AuthenticatorEmulator.DEFAULT_MAKE_CREDENTIAL_INTERACTION,
+            userGetAssertionInteraction: params.userGetAssertionInteraction ?? AuthenticatorEmulator.DEFAULT_GET_ASSERTION_INTERACTION,
+            credentialsRepository: params.stateless ? undefined : AuthenticatorEmulator.DEFAULT_CREDENTIALS_REPOSITORY,
+            stateless: params.stateless ?? AuthenticatorEmulator.DEFAULT_STATELESS,
+        };
+    }
+    /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticator-api */
+    command(request) {
+        const unpackedRequest = (0, ctap_model_1.unpackRequest)(request);
+        if (unpackedRequest.command === ctap_model_1.CTAP_COMMAND.authenticatorMakeCredential) {
+            const makeCredentialRequest = unpackedRequest.request;
+            const makeCredentialResponse = this.authenticatorMakeCredential(makeCredentialRequest);
+            return (0, ctap_model_1.packMakeCredentialResponse)(makeCredentialResponse);
+        }
+        if (unpackedRequest.command === ctap_model_1.CTAP_COMMAND.authenticatorGetAssertion) {
+            const getAssertionRequest = unpackedRequest.request;
+            const getAssertionResponse = this.authenticatorGetAssertion(getAssertionRequest);
+            return (0, ctap_model_1.packGetAssertionResponse)(getAssertionResponse);
+        }
+        if (unpackedRequest.command === ctap_model_1.CTAP_COMMAND.authenticatorGetInfo) {
+            return (0, ctap_model_1.packGetInfoResponse)(this.authenticatorGetInfo());
+        }
+        throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_COMMAND);
+    }
+    /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfo */
+    authenticatorGetInfo() {
+        return {
+            versions: ["FIDO_2_0"],
+            aaguid: this.params.aaguid,
+            options: {
+                rk: true,
+                uv: this.params.verifications.userVerified,
+                up: this.params.verifications.userPresent,
+            },
+        };
+    }
+    /**
+     * @see https://www.w3.org/TR/webauthn/#sctn-op-make-cred
+     * @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential
+     **/
+    authenticatorMakeCredential(request) {
+        const rpId = new webauthn_model_1.RpId(request.rp.id);
+        const repository = this.params.credentialsRepository;
+        // Exclude list
+        if (request.excludeList && request.excludeList.length > 0 && repository) {
+            const existingCredentials = getCredentials(rpId, request.excludeList, repository);
+            if (existingCredentials.length > 0) {
+                throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_CREDENTIAL_EXCLUDED);
+            }
+        }
+        // Algorithm selection
+        const allowAlgSet = new Set(request.pubKeyCredParams.map((param) => param.alg));
+        const alg = this.params.algorithmIdentifiers.find((alg) => allowAlgSet.has(exports.COSEAlgorithmIdentifier[alg]));
+        if (!alg)
+            throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_UNSUPPORTED_ALGORITHM);
+        // User operation
+        const interactionResponse = this.params.userMakeCredentialInteraction(request.user, request.options);
+        if (!interactionResponse)
+            throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_OPERATION_DENIED);
+        // Create credential
+        const credential = makeCredential(this.params.aaguid, rpId, alg, this.params.transports, interactionResponse, request.user, repository ? undefined : AuthenticatorEmulator.ENCRYPT_KEY);
+        if (repository) {
+            const discoverableCredential = {
+                ...credential,
+                user: request.user,
+            };
+            saveCredential(discoverableCredential, repository);
+        }
+        return {
+            fmt: "none",
+            authData: (0, webauthn_model_1.packAuthenticatorData)(credential.authenticatorData),
+            attStmt: {},
+        };
+    }
+    /**
+     * @see https://www.w3.org/TR/webauthn/#sctn-op-get-assertion
+     * @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion
+     **/
+    authenticatorGetAssertion(request) {
+        const rpId = new webauthn_model_1.RpId(request.rpId);
+        const repository = this.params.credentialsRepository;
+        const allowList = request.allowList ?? [];
+        // Allow list
+        const credentials = repository
+            ? getCredentials(rpId, allowList, repository)
+            : getCredentialsStateless(rpId, allowList, AuthenticatorEmulator.ENCRYPT_KEY);
+        if (credentials.length === 0)
+            throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS);
+        const credential = credentials[credentials.length - 1];
+        // User operation
+        const interactionResponse = this.params.userGetAssertionInteraction(credential.user, request.options);
+        if (!interactionResponse)
+            throw new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_OPERATION_DENIED);
+        // Get assertion
+        const newSignCount = !repository ? 0 : credential.authenticatorData.signCount + this.params.signCounterIncrement;
+        const { authData, signature } = getAssertion(rpId.hash, request.clientDataHash, newSignCount, credential.publicKeyCredentialSource, interactionResponse, !repository);
+        // Update sign count
+        if (repository && credential.user) {
+            const updatedCredential = {
+                ...credential,
+                authenticatorData: {
+                    ...credential.authenticatorData,
+                    signCount: newSignCount,
+                },
+                user: credential.user,
+            };
+            saveCredential(updatedCredential, repository);
+        }
+        return {
+            credential: request.allowList?.length === 1 ? undefined : credential.publicKeyCredentialDescriptor,
+            authData,
+            signature,
+            user: credential.user,
+            numberOfCredentials: credentials.length,
+        };
+    }
+}
+exports.AuthenticatorEmulator = AuthenticatorEmulator;
+function getCredentialsStateless(rpId, allowCredentials, key) {
+    return allowCredentials.map((descriptor) => {
+        const id = encode_utils_1.default.bufferSourceToUint8Array(descriptor.id);
+        const publicKeyCredentialSource = {
+            type: "public-key",
+            id,
+            privateKey: decryptBytes(key, id),
+            rpId: rpId,
+        };
+        const authData = {
+            rpIdHash: rpId.hash,
+            flags: {
+                backupEligibility: false,
+                backupState: false,
+                userPresent: true,
+                userVerified: true,
+                attestedCredentialData: false,
+                extensionData: false,
+            },
+            signCount: 0,
+        };
+        return {
+            publicKeyCredentialDescriptor: descriptor,
+            publicKeyCredentialSource,
+            authenticatorData: authData,
+            user: undefined,
+        };
+    });
+}
+function getCredentials(rpId, credentialsFilter, repository) {
+    const allowIds = new Set(credentialsFilter.map((descriptor) => encode_utils_1.default.encodeBase64Url(descriptor.id)));
+    const credentials = repository.loadCredentials();
+    return credentials.filter((credential) => {
+        if (rpId.value !== credential.publicKeyCredentialSource.rpId.value)
+            return false;
+        if (credentialsFilter.length > 0) {
+            const rawId = credential.publicKeyCredentialDescriptor.id;
+            if (!allowIds?.has(encode_utils_1.default.encodeBase64Url(rawId)))
+                return false;
+        }
+        return true;
+    });
+}
+function saveCredential(credential, repository) {
+    const credentials = repository.loadCredentials();
+    const index = credentials.findIndex((c) => {
+        if (c.publicKeyCredentialSource.rpId.value !== credential.publicKeyCredentialSource.rpId.value)
+            return false;
+        return encode_utils_1.default.encodeBase64Url(c.user.id) === encode_utils_1.default.encodeBase64Url(credential.user.id);
+    });
+    if (index >= 0) {
+        repository.deleteCredential(credentials[index]);
+    }
+    repository.saveCredential(credential);
+}
+function getAssertion(rpIdHash, clientDataHash, newSignCounter, credential, interactionResponse, stateless) {
+    const authenticatorData = {
+        rpIdHash,
+        flags: {
+            userPresent: interactionResponse.options.up,
+            userVerified: interactionResponse.options.uv,
+            backupEligibility: !stateless,
+            backupState: !stateless,
+            attestedCredentialData: false,
+            extensionData: false,
+        },
+        signCount: newSignCounter,
+    };
+    const payload = new Array();
+    payload.push(...(0, webauthn_model_1.packAuthenticatorData)(authenticatorData));
+    payload.push(...clientDataHash);
+    const privateKey = (0, node_crypto_1.createPrivateKey)({
+        format: "der",
+        type: "pkcs8",
+        key: credential.privateKey,
+    });
+    const signature = (0, node_crypto_1.sign)(null, new Uint8Array(payload), privateKey);
+    return { authData: (0, webauthn_model_1.packAuthenticatorData)(authenticatorData), signature };
+}
+function makeCredential(aaguid, rpId, alg, transports, interactionResponse, user, statelessKey) {
+    const generatekeyPair = (alg) => {
+        if (alg === "RS256")
+            return (0, node_crypto_1.generateKeyPairSync)("rsa", { modulusLength: 2048 });
+        if (alg === "EdDSA")
+            return (0, node_crypto_1.generateKeyPairSync)("ed25519");
+        return (0, node_crypto_1.generateKeyPairSync)("ec", { namedCurve: "P-256" });
+    };
+    const keyPair = generatekeyPair(alg);
+    const privateKey = new Uint8Array(keyPair.privateKey.export({ format: "der", type: "pkcs8" }));
+    const credentialId = statelessKey ? encryptBytes(statelessKey, privateKey) : new Uint8Array((0, node_crypto_1.randomBytes)(32));
+    const publicKeyCredentialSource = {
+        type: "public-key",
+        id: credentialId,
+        privateKey: new Uint8Array(keyPair.privateKey.export({ format: "der", type: "pkcs8" })),
+        rpId: rpId,
+        userHandle: user && !statelessKey ? encode_utils_1.default.bufferSourceToUint8Array(user.id) : undefined,
+    };
+    const publicKeyCredentialDescriptor = {
+        type: "public-key",
+        id: credentialId,
+        transports,
+    };
+    const authenticatorData = {
+        rpIdHash: rpId.hash,
+        flags: {
+            backupEligibility: !statelessKey,
+            backupState: !statelessKey,
+            userPresent: interactionResponse.options.up,
+            userVerified: interactionResponse.options.uv,
+            attestedCredentialData: true,
+            extensionData: false,
+        },
+        signCount: 0,
+        attestedCredentialData: {
+            aaguid,
+            credentialId,
+            credentialPublicKey: cose_key_1.CoseKey.fromKeyObject(keyPair.publicKey),
+        },
+    };
+    return {
+        publicKeyCredentialDescriptor,
+        publicKeyCredentialSource,
+        authenticatorData,
+        user,
+    };
+}
+function encryptBytes(key, data) {
+    const iv = (0, node_crypto_1.randomBytes)(16);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-ctr", key, iv);
+    const encrypted = cipher.update(data);
+    return Buffer.concat([iv, encrypted, cipher.final()]);
+}
+function decryptBytes(key, data) {
+    const iv = data.slice(0, 16);
+    const encrypted = data.slice(16);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-ctr", key, iv);
+    return Buffer.concat([cipher.update(encrypted), cipher.final()]);
+}

package/dist/src/authenticator/ctap-model.d.ts

@@ -0,0 +1,107 @@
+export type AuthenticatorOptions = {
+    rk: boolean;
+    uv: boolean;
+    up: boolean;
+};
+export type AuthenticatorInteractionOptions = {
+    up: boolean;
+    uv: boolean;
+};
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential */
+export interface AuthenticatorMakeCredentialRequest {
+    clientDataHash: Uint8Array;
+    rp: PublicKeyCredentialRpEntity & {
+        id: string;
+    };
+    user: PublicKeyCredentialUserEntity;
+    pubKeyCredParams: PublicKeyCredentialParameters[];
+    excludeList?: PublicKeyCredentialDescriptor[];
+    extensions?: object;
+    options?: Partial<AuthenticatorOptions>;
+    pinAuth?: Uint8Array;
+    pinProtocol?: number;
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential */
+export interface AuthenticatorMakeCredentialResponse {
+    fmt: string;
+    authData: Uint8Array;
+    attStmt: object;
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion */
+export interface AuthenticatorGetAssertionRequest {
+    rpId: string;
+    clientDataHash: Uint8Array;
+    allowList?: PublicKeyCredentialDescriptor[];
+    extensions?: object;
+    options?: Partial<AuthenticatorOptions>;
+    pinAuth?: Uint8Array;
+    pinProtocol?: number;
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion */
+export interface AuthenticatorGetAssertionResponse {
+    credential?: PublicKeyCredentialDescriptor;
+    authData: Uint8Array;
+    signature: Uint8Array;
+    user?: PublicKeyCredentialUserEntity;
+    numberOfCredentials: number;
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfo */
+export type AuthenticatorGetInfoResponse = {
+    versions: string[];
+    extensions?: string[];
+    aaguid: Uint8Array;
+    options?: Partial<AuthenticatorOptions> & {
+        plat?: boolean;
+        clientPin?: boolean;
+    };
+    maxMsgSize?: number;
+    pinProtocols?: number[];
+};
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#error-responses */
+export declare enum CTAP_STATUS_CODE {
+    CTAP2_OK = 0,
+    CTAP1_ERR_INVALID_COMMAND = 1,
+    CTAP1_ERR_INVALID_PARAMETER = 2,
+    CTAP2_ERR_INVALID_CBOR = 18,
+    CTAP2_ERR_CREDENTIAL_EXCLUDED = 25,
+    CTAP2_ERR_UNSUPPORTED_ALGORITHM = 38,
+    CTAP2_ERR_OPERATION_DENIED = 39,
+    CTAP2_ERR_NO_CREDENTIALS = 46,
+    CTAP2_ERR_NOT_ALLOWED = 48
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#commands */
+export declare enum CTAP_COMMAND {
+    authenticatorMakeCredential = 1,
+    authenticatorGetAssertion = 2,
+    authenticatorGetInfo = 4,
+    authenticatorClientPIN = 6,
+    authenticatorReset = 7,
+    authenticatorGetNextAssertion = 8
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses */
+export interface CTAPAuthenticatorResponse {
+    status: CTAP_STATUS_CODE;
+    data?: Uint8Array;
+}
+/** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#commands */
+export interface CTAPAuthenticatorRequest {
+    command: CTAP_COMMAND;
+    data?: Uint8Array;
+}
+export declare class AuthenticationEmulatorError extends Error {
+    status: CTAP_STATUS_CODE;
+    type: string;
+    constructor(status: CTAP_STATUS_CODE, options?: ErrorOptions);
+}
+export declare function unpackRequest(request: CTAPAuthenticatorRequest): {
+    command: CTAP_COMMAND;
+    request: unknown;
+};
+export declare function packMakeCredentialRequest(request: AuthenticatorMakeCredentialRequest): CTAPAuthenticatorRequest;
+export declare function packGetAssertionRequest(request: AuthenticatorGetAssertionRequest): CTAPAuthenticatorRequest;
+export declare function unpackMakeCredentialResponse(response: CTAPAuthenticatorResponse): AuthenticatorMakeCredentialResponse;
+export declare function packMakeCredentialResponse(response: AuthenticatorMakeCredentialResponse): CTAPAuthenticatorResponse;
+export declare function unpackGetAssertionResponse(response: CTAPAuthenticatorResponse): AuthenticatorGetAssertionResponse;
+export declare function packGetAssertionResponse(response: AuthenticatorGetAssertionResponse): CTAPAuthenticatorResponse;
+export declare function unpackGetInfoResponse(response: CTAPAuthenticatorResponse): AuthenticatorGetInfoResponse;
+export declare function packGetInfoResponse(response: AuthenticatorGetInfoResponse): CTAPAuthenticatorResponse;