nid-webauthn-emulator 0.1.3

package/dist/src/webauthn/cose-key.js

@@ -0,0 +1,151 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoseKey = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const encode_utils_1 = __importDefault(require("../libs/encode-utils"));
+/** @see https://www.w3.org/TR/webauthn/#sctn-encoded-credPubKey-examples */
+class CoseKey {
+    kty;
+    alg;
+    constructor(kty, alg) {
+        this.kty = kty;
+        this.alg = alg;
+    }
+    toKeyObject() {
+        return node_crypto_1.default.createPublicKey({ format: "jwk", key: this.toJwk() });
+    }
+    static fromKeyObject(keyObject) {
+        return CoseKey.fromJwk(keyObject.export({ format: "jwk" }));
+    }
+    toDer() {
+        return this.toKeyObject().export({ format: "der", type: "spki" });
+    }
+    static fromDer(der) {
+        return CoseKey.fromKeyObject(node_crypto_1.default.createPublicKey({ format: "der", type: "spki", key: Buffer.from(der) }));
+    }
+    equals(other) {
+        return this.toKeyObject().equals(other.toKeyObject());
+    }
+    static fromBytes(bytes) {
+        const coseKey = encode_utils_1.default.decodeCbor(bytes);
+        switch (coseKey[3]) {
+            case -7:
+                return CoseKeyP256.fromBytes(bytes);
+            case -8:
+                return CoseKeyEd25519.fromBytes(bytes);
+            case -257:
+                return CoseKeyRSA.fromBytes(bytes);
+            default:
+                throw new Error("Not supported key type");
+        }
+    }
+    static fromJwk(jwk) {
+        if (jwk.crv === "P-256")
+            return CoseKeyP256.fromJwk(jwk);
+        if (jwk.crv === "Ed25519")
+            return CoseKeyEd25519.fromJwk(jwk);
+        if (jwk.kty === "RSA")
+            return CoseKeyRSA.fromJwk(jwk);
+        throw new Error("Not supported key type");
+    }
+}
+exports.CoseKey = CoseKey;
+class CoseKeyP256 extends CoseKey {
+    x;
+    y;
+    constructor(x, y) {
+        super(2, -7);
+        this.x = x;
+        this.y = y;
+    }
+    toBytes() {
+        const coseKey = {
+            1: this.kty,
+            3: this.alg,
+            [-1]: 1,
+            [-2]: this.x,
+            [-3]: this.y,
+        };
+        return encode_utils_1.default.encodeCbor(coseKey);
+    }
+    toJwk() {
+        return {
+            kty: "EC",
+            crv: "P-256",
+            x: encode_utils_1.default.encodeBase64Url(this.x),
+            y: encode_utils_1.default.encodeBase64Url(this.y),
+        };
+    }
+    static fromBytes(bytes) {
+        const coseKey = encode_utils_1.default.decodeCbor(bytes);
+        return new CoseKeyP256(coseKey[-2], coseKey[-3]);
+    }
+    static fromJwk(jwk) {
+        return new CoseKeyP256(encode_utils_1.default.decodeBase64Url(jwk.x), encode_utils_1.default.decodeBase64Url(jwk.y));
+    }
+}
+class CoseKeyEd25519 extends CoseKey {
+    x;
+    constructor(x) {
+        super(1, -8);
+        this.x = x;
+    }
+    toBytes() {
+        const coseKey = {
+            1: this.kty,
+            3: this.alg,
+            [-1]: 6,
+            [-2]: this.x,
+        };
+        return encode_utils_1.default.encodeCbor(coseKey);
+    }
+    toJwk() {
+        return {
+            kty: "OKP",
+            crv: "Ed25519",
+            x: encode_utils_1.default.encodeBase64Url(this.x),
+        };
+    }
+    static fromBytes(bytes) {
+        const coseKey = encode_utils_1.default.decodeCbor(bytes);
+        return new CoseKeyEd25519(coseKey[-2]);
+    }
+    static fromJwk(jwk) {
+        return new CoseKeyEd25519(encode_utils_1.default.decodeBase64Url(jwk.x));
+    }
+}
+class CoseKeyRSA extends CoseKey {
+    n;
+    e;
+    constructor(n, e) {
+        super(3, -257);
+        this.n = n;
+        this.e = e;
+    }
+    toBytes() {
+        const coseKey = {
+            1: this.kty,
+            3: this.alg,
+            [-1]: this.n,
+            [-2]: this.e,
+        };
+        return encode_utils_1.default.encodeCbor(coseKey);
+    }
+    toJwk() {
+        return {
+            kty: "RSA",
+            n: encode_utils_1.default.encodeBase64Url(this.n),
+            e: encode_utils_1.default.encodeBase64Url(this.e),
+        };
+    }
+    static fromBytes(bytes) {
+        const coseKey = encode_utils_1.default.decodeCbor(bytes);
+        return new CoseKeyRSA(coseKey[-1], coseKey[-2]);
+    }
+    static fromJwk(jwk) {
+        return new CoseKeyRSA(encode_utils_1.default.decodeBase64Url(jwk.n), encode_utils_1.default.decodeBase64Url(jwk.e));
+    }
+}

package/dist/src/webauthn/webauthn-emulator.d.ts

@@ -0,0 +1,30 @@
+import { AuthenticatorEmulator } from "../authenticator/authenticator-emulator";
+import { type AuthenticationResponseJSON, type CreatePublicKeyCredential, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON, type RegistrationResponseJSON, type RequestPublicKeyCredential } from "./webauthn-model-json";
+export type AuthenticatorInfo = {
+    version: string;
+    aaguid: string;
+    options: {
+        rk?: boolean;
+        uv?: boolean;
+    };
+};
+export declare class WebAuthnEmulatorError extends Error {
+}
+export declare class NoPublicKeyError extends WebAuthnEmulatorError {
+}
+export declare class InvalidRpIdError extends WebAuthnEmulatorError {
+}
+/**
+ * WebAuthn emulator
+ */
+export declare class WebAuthnEmulator {
+    authenticator: AuthenticatorEmulator;
+    constructor(authenticator?: AuthenticatorEmulator);
+    getJSON(origin: string, optionsJSON: PublicKeyCredentialRequestOptionsJSON): AuthenticationResponseJSON;
+    createJSON(origin: string, optionsJSON: PublicKeyCredentialCreationOptionsJSON): RegistrationResponseJSON;
+    getAuthenticatorInfo(): AuthenticatorInfo;
+    /** @see https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get */
+    get(origin: string, options: CredentialRequestOptions): RequestPublicKeyCredential;
+    /** @see https://developer.mozilla.org/ja/docs/Web/API/CredentialsContainer/create */
+    create(origin: string, options: CredentialCreationOptions): CreatePublicKeyCredential;
+}

package/dist/src/webauthn/webauthn-emulator.js

@@ -0,0 +1,142 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthnEmulator = exports.InvalidRpIdError = exports.NoPublicKeyError = exports.WebAuthnEmulatorError = void 0;
+const authenticator_emulator_1 = require("../authenticator/authenticator-emulator");
+const encode_utils_1 = __importDefault(require("../libs/encode-utils"));
+const webauthn_model_json_1 = require("./webauthn-model-json");
+const node_crypto_1 = require("node:crypto");
+const ctap_model_1 = require("../authenticator/ctap-model");
+const webauthn_model_1 = require("./webauthn-model");
+class WebAuthnEmulatorError extends Error {
+}
+exports.WebAuthnEmulatorError = WebAuthnEmulatorError;
+class NoPublicKeyError extends WebAuthnEmulatorError {
+}
+exports.NoPublicKeyError = NoPublicKeyError;
+class InvalidRpIdError extends WebAuthnEmulatorError {
+}
+exports.InvalidRpIdError = InvalidRpIdError;
+/**
+ * WebAuthn emulator
+ */
+class WebAuthnEmulator {
+    authenticator;
+    constructor(authenticator = new authenticator_emulator_1.AuthenticatorEmulator()) {
+        this.authenticator = authenticator;
+    }
+    getJSON(origin, optionsJSON) {
+        const options = (0, webauthn_model_json_1.parseRequestOptionsFromJSON)(optionsJSON);
+        const response = this.get(origin, { publicKey: options });
+        return response.toJSON();
+    }
+    createJSON(origin, optionsJSON) {
+        const options = (0, webauthn_model_json_1.parseCreationOptionsFromJSON)(optionsJSON);
+        const response = this.create(origin, { publicKey: options });
+        return response.toJSON();
+    }
+    getAuthenticatorInfo() {
+        const authenticatorInfo = (0, ctap_model_1.unpackGetInfoResponse)(this.authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorGetInfo }));
+        return {
+            version: authenticatorInfo.versions.join(", "),
+            aaguid: encode_utils_1.default.encodeBase64Url(authenticatorInfo.aaguid),
+            options: {
+                rk: authenticatorInfo.options?.rk,
+                uv: authenticatorInfo.options?.uv,
+            },
+        };
+    }
+    /** @see https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get */
+    get(origin, options) {
+        if (!options.publicKey)
+            throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
+        const rpId = new webauthn_model_1.RpId(options.publicKey.rpId ?? new URL(origin).hostname);
+        if (!rpId.validate(origin))
+            throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
+        const clientData = {
+            type: "webauthn.get",
+            challenge: encode_utils_1.default.encodeBase64Url(options.publicKey.challenge),
+            origin,
+            crossOrigin: false,
+        };
+        const authenticatorRequest = (0, ctap_model_1.packGetAssertionRequest)({
+            rpId: rpId.value,
+            clientDataHash: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(clientData)).digest(),
+            allowList: options.publicKey.allowCredentials,
+            options: (0, webauthn_model_1.toFido2RequestOptions)(options.publicKey.userVerification),
+        });
+        const authenticatorResponse = (0, ctap_model_1.unpackGetAssertionResponse)(this.authenticator.command(authenticatorRequest));
+        const responseId = authenticatorResponse.credential?.id ?? options.publicKey.allowCredentials?.[0]?.id;
+        const authData = (0, webauthn_model_1.unpackAuthenticatorData)(authenticatorResponse.authData);
+        const rawId = encode_utils_1.default.bufferSourceToUint8Array(responseId);
+        const publicKeyCredential = {
+            id: encode_utils_1.default.encodeBase64Url(rawId),
+            type: "public-key",
+            rawId,
+            response: {
+                clientDataJSON: encode_utils_1.default.strToUint8Array(JSON.stringify(clientData)),
+                authenticatorData: (0, webauthn_model_1.packAuthenticatorData)(authData),
+                signature: authenticatorResponse.signature,
+                userHandle: authenticatorResponse.user
+                    ? encode_utils_1.default.bufferSourceToUint8Array(authenticatorResponse.user.id)
+                    : null,
+            },
+            authenticatorAttachment: null,
+            getClientExtensionResults: () => ({ credProps: { rk: authenticatorResponse.user !== undefined } }),
+            toJSON: () => (0, webauthn_model_json_1.toAuthenticationResponseJSON)(publicKeyCredential),
+        };
+        return publicKeyCredential;
+    }
+    /** @see https://developer.mozilla.org/ja/docs/Web/API/CredentialsContainer/create */
+    create(origin, options) {
+        if (!options.publicKey)
+            throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
+        const rpId = new webauthn_model_1.RpId(options.publicKey.rp.id ?? new URL(origin).hostname);
+        if (!rpId.validate(origin))
+            throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
+        const clientData = {
+            challenge: encode_utils_1.default.encodeBase64Url(options.publicKey.challenge),
+            origin,
+            type: "webauthn.create",
+            crossOrigin: false,
+        };
+        const clientDataJSON = JSON.stringify(clientData);
+        const authenticatorRequest = (0, ctap_model_1.packMakeCredentialRequest)({
+            clientDataHash: (0, node_crypto_1.createHash)("sha256").update(clientDataJSON).digest(),
+            rp: { name: options.publicKey.rp.name, id: rpId.value },
+            user: options.publicKey.user,
+            pubKeyCredParams: options.publicKey.pubKeyCredParams,
+            excludeList: options.publicKey.excludeCredentials,
+            options: (0, webauthn_model_1.toFido2CreateOptions)(options.publicKey.authenticatorSelection),
+        });
+        const authenticatorResponse = (0, ctap_model_1.unpackMakeCredentialResponse)(this.authenticator.command(authenticatorRequest));
+        const authData = (0, webauthn_model_1.unpackAuthenticatorData)(authenticatorResponse.authData);
+        const attestedCredentialData = authData.attestedCredentialData;
+        const attestationObject = {
+            fmt: "none",
+            attStmt: {},
+            authData,
+        };
+        const response = {
+            attestationObject: (0, webauthn_model_1.packAttestationObject)(attestationObject),
+            clientDataJSON: encode_utils_1.default.strToUint8Array(clientDataJSON),
+            getAuthenticatorData: () => (0, webauthn_model_1.packAuthenticatorData)(authData),
+            getPublicKey: () => attestedCredentialData.credentialPublicKey.toDer(),
+            getPublicKeyAlgorithm: () => attestedCredentialData.credentialPublicKey.alg,
+            getTransports: () => this.authenticator.params.transports,
+        };
+        const publicKeyCredential = {
+            id: encode_utils_1.default.encodeBase64Url(attestedCredentialData.credentialId),
+            type: "public-key",
+            rawId: attestedCredentialData.credentialId,
+            response,
+            authenticatorAttachment: null,
+            getClientExtensionResults: () => ({ credProps: { rk: true } }),
+            toJSON: () => (0, webauthn_model_json_1.toRegistrationResponseJSON)(publicKeyCredential),
+        };
+        return publicKeyCredential;
+    }
+}
+exports.WebAuthnEmulator = WebAuthnEmulator;

package/dist/src/webauthn/webauthn-model-json.d.ts

@@ -0,0 +1,101 @@
+type Base64urlString = string;
+type AuthenticationExtensionsClientInputsJSON = object;
+type AuthenticationExtensionsClientOutputsJSON = object;
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialcreationoptionsjson */
+export interface PublicKeyCredentialCreationOptionsJSON {
+    readonly rp: PublicKeyCredentialRpEntity;
+    readonly user: PublicKeyCredentialUserEntityJSON;
+    readonly challenge: Base64urlString;
+    readonly pubKeyCredParams: PublicKeyCredentialParameters[];
+    readonly timeout?: number;
+    readonly excludeCredentials?: PublicKeyCredentialDescriptorJSON[];
+    readonly authenticatorSelection?: AuthenticatorSelectionCriteria;
+    readonly hints?: string[];
+    readonly attestation?: string;
+    readonly attestationFormats?: string[];
+    readonly extensions?: AuthenticationExtensionsClientInputsJSON;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialuserentityjson */
+export interface PublicKeyCredentialUserEntityJSON {
+    readonly id: Base64urlString;
+    readonly name: string;
+    readonly displayName: string;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialdescriptorjson */
+export interface PublicKeyCredentialDescriptorJSON {
+    readonly id: Base64urlString;
+    readonly type: string;
+    transports?: string[];
+}
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-parseCreationOptionsFromJSON */
+export declare function parseCreationOptionsFromJSON(optionsJSON: PublicKeyCredentialCreationOptionsJSON): PublicKeyCredentialCreationOptions;
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialrequestoptionsjson */
+export interface PublicKeyCredentialRequestOptionsJSON {
+    readonly challenge: Base64urlString;
+    readonly timeout?: number;
+    readonly rpId?: string;
+    readonly allowCredentials?: PublicKeyCredentialDescriptorJSON[];
+    readonly userVerification?: string;
+    readonly hints?: string[];
+    readonly attestation?: string;
+    readonly attestationFormats?: string[];
+    readonly extensions?: AuthenticationExtensionsClientInputsJSON;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-parseRequestOptionsFromJSON */
+export declare function parseRequestOptionsFromJSON(optionsJSON: PublicKeyCredentialRequestOptionsJSON): PublicKeyCredentialRequestOptions;
+export interface CreatePublicKeyCredential extends PublicKeyCredential {
+    response: AuthenticatorAttestationResponse;
+    toJSON(): RegistrationResponseJSON;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-registrationresponsejson */
+export interface RegistrationResponseJSON {
+    readonly id: Base64urlString;
+    readonly rawId: Base64urlString;
+    readonly response: AuthenticatorAttestationResponseJSON;
+    readonly authenticatorAttachment?: AuthenticatorAttachment;
+    readonly clientExtensionResults: AuthenticationExtensionsClientOutputsJSON;
+    readonly type: PublicKeyCredentialType;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-authenticatorattestationresponsejson */
+interface AuthenticatorAttestationResponseJSON {
+    readonly clientDataJSON: Base64urlString;
+    readonly authenticatorData: Base64urlString;
+    readonly transports: AuthenticatorTransport[];
+    readonly publicKey?: Base64urlString;
+    readonly publicKeyAlgorithm?: number;
+    readonly attestationObject: Base64urlString;
+}
+export interface RequestPublicKeyCredential extends PublicKeyCredential {
+    response: AuthenticatorAssertionResponse;
+    toJSON(): AuthenticationResponseJSON;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-authenticationresponsejson */
+export interface AuthenticationResponseJSON {
+    readonly id: Base64urlString;
+    readonly rawId: Base64urlString;
+    readonly response: AuthenticatorAssertionResponseJSON;
+    readonly authenticatorAttachment?: AuthenticatorAttachment;
+    readonly clientExtensionResults: AuthenticationExtensionsClientOutputsJSON;
+    readonly type: PublicKeyCredentialType;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#dictdef-authenticatorassertionresponsejson */
+interface AuthenticatorAssertionResponseJSON {
+    readonly clientDataJSON: Base64urlString;
+    readonly authenticatorData: Base64urlString;
+    readonly signature: Base64urlString;
+    readonly userHandle?: Base64urlString;
+    readonly attestationObject?: Base64urlString;
+}
+export declare function toRegistrationResponseJSON(credential: PublicKeyCredential): RegistrationResponseJSON;
+export declare function toAuthenticationResponseJSON(credential: PublicKeyCredential): AuthenticationResponseJSON;
+export declare function toCreationOptionsJSON(options: PublicKeyCredentialCreationOptions): PublicKeyCredentialCreationOptionsJSON;
+export declare function toRequestOptionsJSON(options: PublicKeyCredentialRequestOptions): PublicKeyCredentialRequestOptionsJSON;
+export declare function parseRegistrationResponseFromJSON(options: RegistrationResponseJSON): CreatePublicKeyCredential;
+export declare function parseAuthenticationResponseFromJSON(options: AuthenticationResponseJSON): RequestPublicKeyCredential;
+export declare function toPublicKeyCredentialDescriptorJSON(credential: PublicKeyCredentialDescriptor): PublicKeyCredentialDescriptorJSON;
+export declare function parsePublicKeyCredentialDescriptorFromJSON(credential: PublicKeyCredentialDescriptorJSON): PublicKeyCredentialDescriptor;
+export declare function toPublicKeyCredentialUserEntityJSON(user: PublicKeyCredentialUserEntity): PublicKeyCredentialUserEntityJSON;
+export declare function parsePublicKeyCredentialUserEntityFromJSON(user: PublicKeyCredentialUserEntityJSON): PublicKeyCredentialUserEntity;
+export declare function encodeBase64Url(buffer: BufferSource): string;
+export declare function decodeBase64Url(base64Url: string): ArrayBuffer;
+export {};

package/dist/src/webauthn/webauthn-model-json.js

@@ -0,0 +1,187 @@
+"use strict";
+// Do not import anything here, it should be a standalone file
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCreationOptionsFromJSON = parseCreationOptionsFromJSON;
+exports.parseRequestOptionsFromJSON = parseRequestOptionsFromJSON;
+exports.toRegistrationResponseJSON = toRegistrationResponseJSON;
+exports.toAuthenticationResponseJSON = toAuthenticationResponseJSON;
+exports.toCreationOptionsJSON = toCreationOptionsJSON;
+exports.toRequestOptionsJSON = toRequestOptionsJSON;
+exports.parseRegistrationResponseFromJSON = parseRegistrationResponseFromJSON;
+exports.parseAuthenticationResponseFromJSON = parseAuthenticationResponseFromJSON;
+exports.toPublicKeyCredentialDescriptorJSON = toPublicKeyCredentialDescriptorJSON;
+exports.parsePublicKeyCredentialDescriptorFromJSON = parsePublicKeyCredentialDescriptorFromJSON;
+exports.toPublicKeyCredentialUserEntityJSON = toPublicKeyCredentialUserEntityJSON;
+exports.parsePublicKeyCredentialUserEntityFromJSON = parsePublicKeyCredentialUserEntityFromJSON;
+exports.encodeBase64Url = encodeBase64Url;
+exports.decodeBase64Url = decodeBase64Url;
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-parseCreationOptionsFromJSON */
+function parseCreationOptionsFromJSON(optionsJSON) {
+    return {
+        rp: optionsJSON.rp,
+        user: parsePublicKeyCredentialUserEntityFromJSON(optionsJSON.user),
+        challenge: decodeBase64Url(optionsJSON.challenge),
+        pubKeyCredParams: optionsJSON.pubKeyCredParams,
+        timeout: optionsJSON.timeout,
+        excludeCredentials: optionsJSON.excludeCredentials?.map(parsePublicKeyCredentialDescriptorFromJSON),
+        authenticatorSelection: optionsJSON.authenticatorSelection,
+        attestation: optionsJSON.attestation,
+        extensions: optionsJSON.extensions,
+    };
+}
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-parseRequestOptionsFromJSON */
+function parseRequestOptionsFromJSON(optionsJSON) {
+    return {
+        challenge: decodeBase64Url(optionsJSON.challenge),
+        timeout: optionsJSON.timeout,
+        rpId: optionsJSON.rpId,
+        allowCredentials: optionsJSON.allowCredentials?.map(parsePublicKeyCredentialDescriptorFromJSON),
+        userVerification: optionsJSON.userVerification,
+        extensions: optionsJSON.extensions,
+    };
+}
+// Not standard mapping functions
+function toRegistrationResponseJSON(credential) {
+    const attestationResponse = credential.response;
+    const publicKey = attestationResponse.getPublicKey();
+    const algorithm = attestationResponse.getPublicKeyAlgorithm();
+    const responseJSON = {
+        clientDataJSON: encodeBase64Url(attestationResponse.clientDataJSON),
+        authenticatorData: encodeBase64Url(attestationResponse.getAuthenticatorData()),
+        transports: attestationResponse.getTransports(),
+        publicKey: publicKey ? encodeBase64Url(publicKey) : undefined,
+        publicKeyAlgorithm: algorithm === -1 ? undefined : algorithm,
+        attestationObject: encodeBase64Url(attestationResponse.attestationObject),
+    };
+    return {
+        id: credential.id,
+        rawId: credential.id,
+        response: responseJSON,
+        authenticatorAttachment: credential.authenticatorAttachment === null
+            ? undefined
+            : credential.authenticatorAttachment,
+        clientExtensionResults: credential.getClientExtensionResults(),
+        type: credential.type,
+    };
+}
+function toAuthenticationResponseJSON(credential) {
+    const assertionResponse = credential.response;
+    const responseJson = {
+        clientDataJSON: encodeBase64Url(assertionResponse.clientDataJSON),
+        authenticatorData: encodeBase64Url(assertionResponse.authenticatorData),
+        signature: encodeBase64Url(assertionResponse.signature),
+        userHandle: assertionResponse.userHandle ? encodeBase64Url(assertionResponse.userHandle) : undefined,
+    };
+    return {
+        id: credential.id,
+        rawId: credential.id,
+        response: responseJson,
+        authenticatorAttachment: credential.authenticatorAttachment === null
+            ? undefined
+            : credential.authenticatorAttachment,
+        clientExtensionResults: credential.getClientExtensionResults(),
+        type: credential.type,
+    };
+}
+function toCreationOptionsJSON(options) {
+    return {
+        rp: options.rp,
+        user: toPublicKeyCredentialUserEntityJSON(options.user),
+        challenge: encodeBase64Url(options.challenge),
+        pubKeyCredParams: options.pubKeyCredParams,
+        timeout: options.timeout,
+        excludeCredentials: options.excludeCredentials?.map(toPublicKeyCredentialDescriptorJSON),
+        authenticatorSelection: options.authenticatorSelection,
+        attestation: options.attestation,
+        extensions: options.extensions,
+    };
+}
+function toRequestOptionsJSON(options) {
+    return {
+        challenge: encodeBase64Url(options.challenge),
+        timeout: options.timeout,
+        rpId: options.rpId,
+        allowCredentials: options.allowCredentials?.map(toPublicKeyCredentialDescriptorJSON),
+        userVerification: options.userVerification,
+        extensions: options.extensions,
+    };
+}
+function parseRegistrationResponseFromJSON(options) {
+    return {
+        id: options.id,
+        rawId: decodeBase64Url(options.rawId),
+        response: {
+            clientDataJSON: decodeBase64Url(options.response.clientDataJSON),
+            getAuthenticatorData: () => decodeBase64Url(options.response.authenticatorData),
+            getTransports: () => options.response.transports,
+            getPublicKey: () => (options.response.publicKey ? decodeBase64Url(options.response.publicKey) : null),
+            getPublicKeyAlgorithm: () => options.response.publicKeyAlgorithm ?? -1,
+            attestationObject: decodeBase64Url(options.response.attestationObject),
+        },
+        authenticatorAttachment: options.authenticatorAttachment ?? null,
+        getClientExtensionResults: () => options.clientExtensionResults,
+        toJSON: () => options,
+        type: options.type,
+    };
+}
+function parseAuthenticationResponseFromJSON(options) {
+    return {
+        id: options.id,
+        rawId: decodeBase64Url(options.rawId),
+        response: {
+            clientDataJSON: decodeBase64Url(options.response.clientDataJSON),
+            authenticatorData: decodeBase64Url(options.response.authenticatorData),
+            signature: decodeBase64Url(options.response.signature),
+            userHandle: options.response.userHandle ? decodeBase64Url(options.response.userHandle) : null,
+        },
+        authenticatorAttachment: options.authenticatorAttachment ?? null,
+        getClientExtensionResults: () => options.clientExtensionResults,
+        toJSON: () => options,
+        type: options.type,
+    };
+}
+function toPublicKeyCredentialDescriptorJSON(credential) {
+    return {
+        id: encodeBase64Url(credential.id),
+        type: credential.type,
+        transports: credential.transports,
+    };
+}
+function parsePublicKeyCredentialDescriptorFromJSON(credential) {
+    return {
+        id: decodeBase64Url(credential.id),
+        type: credential.type,
+        transports: credential.transports,
+    };
+}
+function toPublicKeyCredentialUserEntityJSON(user) {
+    return { ...user, id: encodeBase64Url(user.id) };
+}
+function parsePublicKeyCredentialUserEntityFromJSON(user) {
+    return { ...user, id: decodeBase64Url(user.id) };
+}
+// Helper functions
+function encodeBase64Url(buffer) {
+    const toArrayBuffer = (bufferSource) => {
+        if (bufferSource instanceof ArrayBuffer) {
+            return bufferSource;
+        }
+        return bufferSource.buffer.slice(bufferSource.byteOffset, bufferSource.byteOffset + bufferSource.byteLength);
+    };
+    return btoa(String.fromCharCode(...new Uint8Array(toArrayBuffer(buffer))))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+function decodeBase64Url(base64Url) {
+    const base64 = base64Url
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(base64Url.length + ((4 - (base64Url.length % 4)) % 4), "=");
+    const binaryString = atob(base64);
+    const byteArray = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        byteArray[i] = binaryString.charCodeAt(i);
+    }
+    return byteArray.buffer;
+}

package/dist/src/webauthn/webauthn-model.d.ts

@@ -0,0 +1,68 @@
+import type { AuthenticatorInteractionOptions, AuthenticatorOptions } from "../authenticator/ctap-model";
+import { CoseKey } from "./cose-key";
+export declare class RpId {
+    readonly value: string;
+    constructor(value: string);
+    get hash(): Uint8Array;
+    /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
+    validate(origin: string): boolean;
+}
+/** @see https://www.w3.org/TR/webauthn-3/#public-key-credential-source */
+export type PublicKeyCredentialSource = {
+    type: "public-key";
+    id: Uint8Array;
+    privateKey: Uint8Array;
+    rpId: RpId;
+    userHandle?: Uint8Array;
+};
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-attested-credential-data */
+export type AttestedCredentialData = {
+    aaguid: Uint8Array;
+    credentialId: Uint8Array;
+    credentialPublicKey: CoseKey;
+};
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-authenticator-data */
+export type AuthenticatorData = {
+    rpIdHash: Uint8Array;
+    flags: {
+        userPresent?: boolean;
+        userVerified?: boolean;
+        backupEligibility?: boolean;
+        backupState?: boolean;
+        attestedCredentialData?: boolean;
+        extensionData?: boolean;
+    };
+    signCount: number;
+    attestedCredentialData?: AttestedCredentialData;
+    extensions?: object;
+};
+/** @see https://www.w3.org/TR/webauthn-3/#attestation-object */
+export type AttestationObject = {
+    fmt: string;
+    attStmt: object;
+    authData: AuthenticatorData;
+};
+/** @see https://www.w3.org/TR/webauthn-3/#dictionary-client-data */
+export type CollectedClientData = {
+    type: "webauthn.get" | "webauthn.create";
+    challenge: string;
+    origin: string;
+    crossOrigin: boolean;
+};
+export declare function packAttestationObject(attestationObject: AttestationObject): Uint8Array;
+export declare function packAuthenticatorData(authData: AuthenticatorData): Uint8Array;
+export declare function unpackAttestationObject(attestationObject: Uint8Array): AttestationObject;
+export declare function unpackAuthenticatorData(authData: Uint8Array): AuthenticatorData;
+export type PublicKeyCredentialSourceJSON = {
+    type: "public-key";
+    id: string;
+    privateKey: string;
+    rpId: string;
+    userHandle?: string;
+};
+export declare function toPublickeyCredentialSourceJSON(credentialSource: PublicKeyCredentialSource): PublicKeyCredentialSourceJSON;
+export declare function parsePublicKeyCredentialSourceFromJSON(json: PublicKeyCredentialSourceJSON): PublicKeyCredentialSource;
+/** @see https://www.w3.org/TR/webauthn-3/#CreateCred-async-loop */
+export declare function toFido2CreateOptions(criteria?: AuthenticatorSelectionCriteria): AuthenticatorOptions;
+/** @see https://www.w3.org/TR/webauthn-3/#sctn-issuing-cred-request-to-authenticator */
+export declare function toFido2RequestOptions(require?: UserVerificationRequirement): AuthenticatorInteractionOptions;