nid-webauthn-emulator 0.2.5 → 0.2.7

package/dist/spec/authenticator/authenticator-emulator.spec.js

@@ -241,4 +241,71 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
             }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
     });
+    (0, globals_1.describe)("Authenticator Credential Management additional error coverage", () => {
+        (0, globals_1.test)("dispatch default branch throws invalid command", () => {
+            const authenticator = new src_1.AuthenticatorEmulator();
+            // Build a CTAP request with an unknown subCommand to hit default branch
+            const data = encode_utils_1.default.encodeCbor({ "1": -1 });
+            (0, globals_1.expect)(() => authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorCredentialManagement, data })).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_COMMAND));
+        });
+        (0, globals_1.test)("enumerateCredentialsBegin without repository throws not allowed", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const req = (0, ctap_model_1.packCredentialManagementRequest)({
+                subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
+                subCommandParams: { rpId: "example.com" },
+            });
+            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+        (0, globals_1.test)("updateUserInformation without repository throws not allowed", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const req = (0, ctap_model_1.packCredentialManagementRequest)({
+                subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
+                subCommandParams: { rpId: "example.com", user: { id: new Uint8Array([1]), name: "n", displayName: "d" } },
+            });
+            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+        (0, globals_1.test)("deleteCredential without repository throws not allowed", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const req = (0, ctap_model_1.packCredentialManagementRequest)({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
+            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+        (0, globals_1.test)("deleteCredential without credentialId throws invalid parameter", () => {
+            const authenticator = new src_1.AuthenticatorEmulator();
+            const req = (0, ctap_model_1.packCredentialManagementRequest)({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
+            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+        });
+        (0, globals_1.test)("deleteCredential for non-existent id throws no credentials", () => {
+            const authenticator = new src_1.AuthenticatorEmulator();
+            const credentialId = encode_utils_1.default.strToUint8Array("non-existent-id");
+            const req = (0, ctap_model_1.packCredentialManagementRequest)({
+                subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential,
+                subCommandParams: { credentialId },
+            });
+            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+        });
+        (0, globals_1.test)("private enumerateCredentialsBegin guard throws not allowed when repository missing", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const target = authenticator.authenticatorEnumerateCredentialsBegin.bind(authenticator);
+            const call = () => target({
+                subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
+                subCommandParams: { rpId: "x" },
+            });
+            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+        (0, globals_1.test)("private updateUserInformation guard throws not allowed when repository missing", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const target = authenticator.authenticatorUpdateUserInformation.bind(authenticator);
+            const call = () => target({
+                subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
+                subCommandParams: { rpId: "x", user: { id: new Uint8Array([1]), name: "n", displayName: "d" } },
+            });
+            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+        (0, globals_1.test)("private deleteCredential guard throws not allowed when repository missing", () => {
+            const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
+            const target = authenticator.authenticatorDeleteCredential.bind(authenticator);
+            const call = () => target({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
+            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+        });
+    });
 });

package/dist/spec/authenticator/ctap-model.spec.js

@@ -91,4 +91,88 @@ const ctap_model_1 = require("../../src/authenticator/ctap-model");
         };
         (0, globals_1.expect)(() => (0, ctap_model_1.unpackRequest)(request)).toThrow("CTAP error: CTAP2_ERR_INVALID_CBOR (18)");
     });
+    (0, globals_1.test)("unpackRequest default branch returns undefined request for unhandled command", () => {
+        const req = { command: ctap_model_1.CTAP_COMMAND.authenticatorClientPIN }; // not explicitly handled in switch
+        const unpacked = (0, ctap_model_1.unpackRequest)(req);
+        (0, globals_1.expect)(unpacked.command).toBe(ctap_model_1.CTAP_COMMAND.authenticatorClientPIN);
+        (0, globals_1.expect)(unpacked.request).toBeUndefined();
+    });
+    (0, globals_1.test)("credential management request with undefined optional params round-trips", () => {
+        const packed = (0, ctap_model_1.packCredentialManagementRequest)({
+            subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
+            // subCommandParams and pinUvAuth* omitted intentionally
+        });
+        const unpacked = (0, ctap_model_1.unpackCredentialManagementRequest)(packed);
+        (0, globals_1.expect)(unpacked.subCommand).toBe(ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin);
+        (0, globals_1.expect)(unpacked.subCommandParams).toBeUndefined();
+        (0, globals_1.expect)(unpacked.pinUvAuthParam).toBeUndefined();
+        (0, globals_1.expect)(unpacked.pinUvAuthProtocol).toBeUndefined();
+    });
+    (0, globals_1.test)("credential management response optional binary fields handled when absent/present", () => {
+        // Absent case
+        const packedAbsent = (0, ctap_model_1.packCredentialManagementResponse)({});
+        const absent = (0, ctap_model_1.unpackCredentialManagementResponse)(packedAbsent);
+        (0, globals_1.expect)(absent.credentialID).toBeUndefined();
+        (0, globals_1.expect)(absent.publicKey).toBeUndefined();
+        (0, globals_1.expect)(absent.rpIDHash).toBeUndefined();
+        (0, globals_1.expect)(absent.largeBlobKey).toBeUndefined();
+        // Present case
+        const bin = new Uint8Array([1, 2, 3]);
+        const packedPresent = (0, ctap_model_1.packCredentialManagementResponse)({
+            credentialID: bin,
+            publicKey: bin,
+            rpIDHash: bin,
+            largeBlobKey: bin,
+        });
+        const present = (0, ctap_model_1.unpackCredentialManagementResponse)(packedPresent);
+        (0, globals_1.expect)(present.credentialID).toBeDefined();
+        (0, globals_1.expect)(present.publicKey).toBeDefined();
+        (0, globals_1.expect)(present.rpIDHash).toBeDefined();
+        (0, globals_1.expect)(present.largeBlobKey).toBeDefined();
+        if (present.credentialID && present.publicKey && present.rpIDHash && present.largeBlobKey) {
+            (0, globals_1.expect)(Array.from(present.credentialID)).toEqual([1, 2, 3]);
+            (0, globals_1.expect)(Array.from(present.publicKey)).toEqual([1, 2, 3]);
+            (0, globals_1.expect)(Array.from(present.rpIDHash)).toEqual([1, 2, 3]);
+            (0, globals_1.expect)(Array.from(present.largeBlobKey)).toEqual([1, 2, 3]);
+        }
+    });
+    (0, globals_1.test)("unpackCredentialManagementRequest throws on invalid CBOR", () => {
+        const bad = {
+            command: ctap_model_1.CTAP_COMMAND.authenticatorCredentialManagement,
+            data: new Uint8Array([1, 2, 3]),
+        };
+        (0, globals_1.expect)(() => (0, ctap_model_1.unpackCredentialManagementRequest)(bad)).toThrow(/CTAP2_ERR_INVALID_CBOR/);
+    });
+    (0, globals_1.test)("unpackCredentialManagementResponse throws on invalid CBOR", () => {
+        const bad = {
+            status: ctap_model_1.CTAP_STATUS_CODE.CTAP2_OK,
+            data: new Uint8Array([1, 2, 3]),
+        };
+        (0, globals_1.expect)(() => (0, ctap_model_1.unpackCredentialManagementResponse)(bad)).toThrow(/CTAP2_ERR_INVALID_CBOR/);
+    });
+    (0, globals_1.test)("unpackRequest CM includes pinUvAuthParam when present", () => {
+        const pin = new Uint8Array([7, 7]);
+        const packed = (0, ctap_model_1.packCredentialManagementRequest)({
+            subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
+            subCommandParams: { rpId: "example.com" },
+            pinUvAuthParam: pin,
+        });
+        const unpacked = (0, ctap_model_1.unpackRequest)(packed);
+        const req = unpacked.request;
+        const isMgmt = (x) => typeof x === "object" && x !== null && "subCommand" in x;
+        (0, globals_1.expect)(isMgmt(req)).toBe(true);
+        if (isMgmt(req)) {
+            (0, globals_1.expect)(Array.from(req.pinUvAuthParam ?? new Uint8Array())).toEqual([7, 7]);
+        }
+    });
+    (0, globals_1.test)("unpackCredentialManagementRequest includes pinUvAuthParam when present", () => {
+        const pin = new Uint8Array([9, 9]);
+        const packed = (0, ctap_model_1.packCredentialManagementRequest)({
+            subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
+            subCommandParams: { rpId: "example.com" },
+            pinUvAuthParam: pin,
+        });
+        const req = (0, ctap_model_1.unpackCredentialManagementRequest)(packed);
+        (0, globals_1.expect)(Array.from(req.pinUvAuthParam ?? new Uint8Array())).toEqual([9, 9]);
+    });
 });

package/dist/spec/libs/encode-utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/spec/libs/encode-utils.spec.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
+(0, globals_1.describe)("EncodeUtils encodeCbor/decodeCbor edge cases", () => {
+    (0, globals_1.test)("handles ArrayBuffer values within objects and arrays", () => {
+        const ab = new Uint8Array([1, 2, 3]).buffer; // ArrayBuffer branch
+        const ua = new Uint8Array([4, 5]);
+        const obj = {
+            v1: ab,
+            v2: ua,
+            arr: [ab, ua],
+        };
+        const encoded = encode_utils_1.default.encodeCbor(obj);
+        const decoded = encode_utils_1.default.decodeCbor(encoded);
+        // ArrayBuffer is decoded back to Uint8Array
+        (0, globals_1.expect)(decoded.v1).toBeInstanceOf(Uint8Array);
+        (0, globals_1.expect)(Array.from(decoded.v1)).toEqual([1, 2, 3]);
+        // Existing Uint8Array round-trips
+        (0, globals_1.expect)(Array.from(decoded.v2)).toEqual([4, 5]);
+        // Mixed array elements preserved as Uint8Array
+        (0, globals_1.expect)(Array.isArray(decoded.arr)).toBe(true);
+        const [a0, a1] = decoded.arr;
+        (0, globals_1.expect)(Array.from(a0)).toEqual([1, 2, 3]);
+        (0, globals_1.expect)(Array.from(a1)).toEqual([4, 5]);
+    });
+    (0, globals_1.test)("handles Buffer values without conversion in encoder and to Uint8Array on decode", () => {
+        const buf = Buffer.from([9, 8]);
+        const obj = { b: buf };
+        const encoded = encode_utils_1.default.encodeCbor(obj);
+        const decoded = encode_utils_1.default.decodeCbor(encoded);
+        (0, globals_1.expect)(decoded.b).toBeInstanceOf(Uint8Array);
+        (0, globals_1.expect)(Array.from(decoded.b)).toEqual([9, 8]);
+    });
+});

package/dist/spec/webauthn/webauthn-emulator.spec.js

@@ -61,15 +61,21 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         const emulator = new src_1.default();
         const testServer = new webauthn_test_server_1.WebAuthnTestServer();
         const options = await testServer.getRegistrationOptions(user);
-        await (0, globals_1.expect)(async () => {
-            emulator.createJSON(illegalOrigin, options);
-        }).rejects.toThrow(src_1.InvalidRpIdError);
+        const call = () => emulator.createJSON(illegalOrigin, options);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("SecurityError");
+        }
     });
     (0, globals_1.test)("Create Passkeys with no public key credential parameters _ failed to response", async () => {
         const emulator = new src_1.default();
-        await (0, globals_1.expect)(async () => {
-            emulator.create(webauthn_test_server_1.TEST_RP_ORIGIN, {});
-        }).rejects.toThrow(src_1.NoPublicKeyError);
+        const call = () => emulator.create(webauthn_test_server_1.TEST_RP_ORIGIN, {});
+        (0, globals_1.expect)(call).toThrow(TypeError);
     });
     (0, globals_1.test)("Found in the exclude List _ CTAP Error", async () => {
         const emulator = new src_1.default();
@@ -78,18 +84,32 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         const credential = emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options);
         await testServer.getRegistrationVerification(user, credential);
         const options2 = await testServer.getRegistrationOptions(user);
-        await (0, globals_1.expect)(async () => {
-            emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options2);
-        }).rejects.toThrow(new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP2_ERR_CREDENTIAL_EXCLUDED));
+        const call = () => emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options2);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
     });
     (0, globals_1.test)("Invalid algorithm _ CTAP Error", async () => {
         const emulator = new src_1.default();
         const testServer = new webauthn_test_server_1.WebAuthnTestServer();
         const options = await testServer.getRegistrationOptions(user);
         const illegalOptions = { ...options, pubKeyCredParams: [{ type: "public-key", alg: 99 }] };
-        await (0, globals_1.expect)(async () => {
-            emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, illegalOptions);
-        }).rejects.toThrow(new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP2_ERR_UNSUPPORTED_ALGORITHM));
+        const call = () => emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, illegalOptions);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotSupportedError");
+        }
     });
     (0, globals_1.test)("User registration operation failed _ CTAP Error", async () => {
         const authenticator = new src_1.AuthenticatorEmulator({
@@ -98,9 +118,16 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         const emulator = new src_1.default(authenticator);
         const testServer = new webauthn_test_server_1.WebAuthnTestServer();
         const options = await testServer.getRegistrationOptions(user);
-        await (0, globals_1.expect)(async () => {
-            emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options);
-        }).rejects.toThrow(new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP2_ERR_OPERATION_DENIED));
+        const call = () => emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
     });
     (0, globals_1.test)("Create Passkeys without RP ID _ OK", async () => {
         const emulator = new src_1.default();
@@ -168,25 +195,38 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         const [emulator, testServer] = await createCredential();
         const illegalOrigin = `${webauthn_test_server_1.TEST_RP_ORIGIN}_illegal`;
         const options = await testServer.getAuthenticationOptions();
-        await (0, globals_1.expect)(async () => {
-            emulator.getJSON(illegalOrigin, options);
-        }).rejects.toThrow(src_1.InvalidRpIdError);
+        const call = () => emulator.getJSON(illegalOrigin, options);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("SecurityError");
+        }
     });
     (0, globals_1.test)("Request Passkeys with no public key credential parameters _ failed to response", async () => {
         const emulator = new src_1.default();
-        await (0, globals_1.expect)(async () => {
-            emulator.get(webauthn_test_server_1.TEST_RP_ORIGIN, {});
-        }).rejects.toThrow(src_1.NoPublicKeyError);
+        const call = () => emulator.get(webauthn_test_server_1.TEST_RP_ORIGIN, {});
+        (0, globals_1.expect)(call).toThrow(TypeError);
     });
     (0, globals_1.test)("Not found in allow list _ CTAP Error", async () => {
         const [emulator, testServer] = await createCredential();
         const options = await testServer.getAuthenticationOptions();
-        await (0, globals_1.expect)(async () => {
-            emulator.getJSON(webauthn_test_server_1.TEST_RP_ORIGIN, {
-                ...options,
-                allowCredentials: [{ id: "AAAAAA", type: "public-key" }],
-            });
-        }).rejects.toThrow(new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+        const call = () => emulator.getJSON(webauthn_test_server_1.TEST_RP_ORIGIN, {
+            ...options,
+            allowCredentials: [{ id: "AAAAAA", type: "public-key" }],
+        });
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
     });
     (0, globals_1.test)("User authentication operation failed _ CTAP Error", async () => {
         const authenticator = new src_1.AuthenticatorEmulator({
@@ -194,9 +234,16 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         });
         const [emulator, testServer] = await createCredential(authenticator);
         const options = await testServer.getAuthenticationOptions();
-        await (0, globals_1.expect)(async () => {
-            emulator.getJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options);
-        }).rejects.toThrow(new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP2_ERR_OPERATION_DENIED));
+        const call = () => emulator.getJSON(webauthn_test_server_1.TEST_RP_ORIGIN, options);
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
     });
     (0, globals_1.test)("Only one credential is allowed and RP ID is undefined _ credential is undefined and OK", async () => {
         const [emulator, testServer] = await createCredential();
@@ -351,9 +398,16 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         // Create authentication options
         const authOptions = await testServer.getAuthenticationOptions();
         // Standard RP ID validation only
-        await (0, globals_1.expect)(async () => {
-            emulator.getJSON(testServer.origin, authOptions);
-        }).rejects.toThrow(src_1.InvalidRpIdError);
+        const invalidCall = () => emulator.getJSON(testServer.origin, authOptions);
+        (0, globals_1.expect)(invalidCall).toThrow(DOMException);
+        try {
+            invalidCall();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("SecurityError");
+        }
         // Related origins validation
         const authResponse = emulator.getJSON(testServer.origin, authOptions, relatedOrigins);
         (0, globals_1.expect)(authResponse).toBeDefined();
@@ -419,3 +473,253 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         }).toThrow(); // Should throw CTAP2_ERR_NO_CREDENTIALS
     });
 });
+(0, globals_1.describe)("WebAuthnEmulator getClientExtensionResults.rk coverage", () => {
+    (0, globals_1.test)("rk=true when discoverable credential (user present)", async () => {
+        const emulator = new src_1.default(new src_1.AuthenticatorEmulator());
+        const testServer = new webauthn_test_server_1.WebAuthnTestServer();
+        const user = { username: "ext-user", id: "ext-user" };
+        const regOptions = await testServer.getRegistrationOptions(user);
+        const regResp = emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, regOptions);
+        await testServer.getRegistrationVerification(user, regResp);
+        const reqOptions = await testServer.getAuthenticationOptions();
+        const parsed = (0, src_1.parseRequestOptionsFromJSON)(reqOptions);
+        const cred = emulator.get(webauthn_test_server_1.TEST_RP_ORIGIN, { publicKey: parsed });
+        const ext = cred.getClientExtensionResults();
+        (0, globals_1.expect)("credProps" in ext && ext.credProps).toBeTruthy();
+        if ("credProps" in ext && ext.credProps) {
+            (0, globals_1.expect)(ext.credProps.rk).toBe(true);
+        }
+    });
+    (0, globals_1.test)("rk=false with stateless + single allowCredential (no user)", async () => {
+        const emulator = new src_1.default(new src_1.AuthenticatorEmulator({ stateless: true }));
+        const testServer = new webauthn_test_server_1.WebAuthnTestServer();
+        const user = { username: "ext-user2", id: "ext-user2" };
+        const regOptions = await testServer.getRegistrationOptions(user);
+        const regResp = emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, regOptions);
+        await testServer.getRegistrationVerification(user, regResp);
+        const reqOptions = await testServer.getAuthenticationOptions();
+        const singleAllow = {
+            ...reqOptions,
+            allowCredentials: [{ type: "public-key", id: regResp.id }],
+        };
+        const parsed = (0, src_1.parseRequestOptionsFromJSON)(singleAllow);
+        const cred = emulator.get(webauthn_test_server_1.TEST_RP_ORIGIN, { publicKey: parsed });
+        const ext = cred.getClientExtensionResults();
+        (0, globals_1.expect)("credProps" in ext && ext.credProps).toBeTruthy();
+        if ("credProps" in ext && ext.credProps) {
+            (0, globals_1.expect)(ext.credProps.rk).toBe(false);
+        }
+    });
+    (0, globals_1.test)("signalAllAcceptedCredentials skips credentials when userId mismatches", async () => {
+        // repository-backed authenticator with isolated repository
+        const emulator = new src_1.default(new src_1.AuthenticatorEmulator({ credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository() }));
+        const testServer = new webauthn_test_server_1.WebAuthnTestServer();
+        const user = { username: "ext-user3", id: "ext-user3" };
+        const regOptions = await testServer.getRegistrationOptions(user);
+        const regResp = emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, regOptions);
+        const repository = emulator.authenticator.params.credentialsRepository;
+        await testServer.getRegistrationVerification(user, regResp);
+        // credentials exist
+        const before = repository.loadCredentials();
+        (0, globals_1.expect)(before.length).toBe(1);
+        const existingId = before.map((c) => encode_utils_1.default.encodeBase64Url(c.publicKeyCredentialSource.id))[0];
+        const actualUserId = encode_utils_1.default.encodeBase64Url(before[0].user.id);
+        // ensure mismatch by altering actualUserId
+        const wrongUserId = `${actualUserId}-mismatch`;
+        emulator.signalAllAcceptedCredentials({
+            rpId: webauthn_test_server_1.TEST_RP_ORIGIN.replace("https://", ""),
+            userId: wrongUserId,
+            allAcceptedCredentialIds: [], // even though empty, mismatch should skip deletion
+        });
+        const after = repository.loadCredentials();
+        const remainingIds = after.map((c) => encode_utils_1.default.encodeBase64Url(c.publicKeyCredentialSource.id));
+        (0, globals_1.expect)(remainingIds).toContain(existingId); // original credential remains
+        (0, globals_1.expect)(after.length).toBe(1); // unchanged
+    });
+    (0, globals_1.test)("signalAllAcceptedCredentials handles undefined totalCredentials (defaults to 0)", async () => {
+        class BeginNoTotalAuthenticator extends src_1.AuthenticatorEmulator {
+            command(request) {
+                if (request.command === src_1.CTAP_COMMAND.authenticatorCredentialManagement) {
+                    return (0, src_1.packCredentialManagementResponse)({});
+                }
+                return super.command(request);
+            }
+        }
+        const emulator = new src_1.default(new BeginNoTotalAuthenticator());
+        (0, globals_1.expect)(() => emulator.signalAllAcceptedCredentials({
+            rpId: webauthn_test_server_1.TEST_RP_ORIGIN.replace("https://", ""),
+            userId: "any-user",
+            allAcceptedCredentialIds: [],
+        })).not.toThrow();
+    });
+});
+(0, globals_1.describe)("WebAuthnEmulator DOMException mapping coverage", () => {
+    (0, globals_1.test)("signalCurrentUserDetails with invalid parameter → DataError", () => {
+        const emulator = new src_1.default(new src_1.AuthenticatorEmulator());
+        const userId = encode_utils_1.default.encodeBase64Url(encode_utils_1.default.strToUint8Array("uid"));
+        const call = () => emulator.signalCurrentUserDetails({
+            // Force rpId to be undefined to trigger CTAP1_ERR_INVALID_PARAMETER inside authenticator
+            rpId: undefined,
+            userId,
+            name: "n",
+            displayName: "d",
+        });
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("DataError");
+        }
+    });
+    (0, globals_1.test)("getAuthenticatorInfo with invalid CBOR → DataError", () => {
+        class BadCborAuthenticator extends src_1.AuthenticatorEmulator {
+            command() {
+                return { status: src_1.CTAP_STATUS_CODE.CTAP2_OK, data: new Uint8Array([0xff]) };
+            }
+        }
+        const emulator = new src_1.default(new BadCborAuthenticator());
+        const call = () => emulator.getAuthenticatorInfo();
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("DataError");
+        }
+    });
+    (0, globals_1.test)("getAuthenticatorInfo with invalid command → UnknownError", () => {
+        class InvalidCommandAuthenticator extends src_1.AuthenticatorEmulator {
+            command() {
+                throw new src_1.AuthenticationEmulatorError(src_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_COMMAND);
+            }
+        }
+        const emulator = new src_1.default(new InvalidCommandAuthenticator());
+        const call = () => emulator.getAuthenticatorInfo();
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("UnknownError");
+        }
+    });
+});
+(0, globals_1.describe)("WebAuthnEmulator credential management error mapping", () => {
+    (0, globals_1.test)("signalUnknownCredential on stateless authenticator → NotAllowedError", () => {
+        const emulator = new src_1.default(new src_1.AuthenticatorEmulator({ stateless: true }));
+        const call = () => emulator.signalUnknownCredential({
+            rpId: "example.com",
+            credentialId: encode_utils_1.default.encodeBase64Url(encode_utils_1.default.strToUint8Array("nope")),
+        });
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
+    });
+    (0, globals_1.test)("signalUnknownCredential for non-existent credential → NotAllowedError", async () => {
+        const repository = new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository();
+        const authenticator = new src_1.AuthenticatorEmulator({ credentialsRepository: repository });
+        const emulator = new src_1.default(authenticator);
+        const call = () => emulator.signalUnknownCredential({
+            rpId: "example.com",
+            credentialId: encode_utils_1.default.encodeBase64Url(encode_utils_1.default.strToUint8Array("missing")),
+        });
+        (0, globals_1.expect)(call).toThrow(DOMException);
+        try {
+            call();
+            throw new Error("Expected DOMException");
+        }
+        catch (e) {
+            (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e.name).toBe("NotAllowedError");
+        }
+    });
+});
+(0, globals_1.describe)("WebAuthnEmulator invalid CBOR mapping on create/get", () => {
+    (0, globals_1.test)("create path invalid CBOR → DataError", () => {
+        class BadCreateCborAuthenticator extends src_1.AuthenticatorEmulator {
+            command(request) {
+                if (request.command === src_1.CTAP_COMMAND.authenticatorMakeCredential) {
+                    return { status: src_1.CTAP_STATUS_CODE.CTAP2_OK, data: new Uint8Array([0xff]) };
+                }
+                return super.command(request);
+            }
+        }
+        const emulator = new src_1.default(new BadCreateCborAuthenticator());
+        const user = { username: "bad-cbor", id: "bad-cbor" };
+        const server = new webauthn_test_server_1.WebAuthnTestServer();
+        return server.getRegistrationOptions(user).then((opts) => {
+            const call = () => emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, opts);
+            (0, globals_1.expect)(call).toThrow(DOMException);
+            try {
+                call();
+                throw new Error("Expected DOMException");
+            }
+            catch (e) {
+                (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+                (0, globals_1.expect)(e.name).toBe("DataError");
+            }
+        });
+    });
+    (0, globals_1.test)("get path invalid CBOR → DataError", () => {
+        class BadGetCborAuthenticator extends src_1.AuthenticatorEmulator {
+            command(request) {
+                if (request.command === src_1.CTAP_COMMAND.authenticatorGetAssertion) {
+                    return { status: src_1.CTAP_STATUS_CODE.CTAP2_OK, data: new Uint8Array([0xff]) };
+                }
+                return super.command(request);
+            }
+        }
+        const emulator = new src_1.default(new BadGetCborAuthenticator());
+        const server = new webauthn_test_server_1.WebAuthnTestServer();
+        const user = { username: "bad-cbor2", id: "bad-cbor2" };
+        return server.getRegistrationOptions(user).then((reg) => {
+            const regResp = emulator.createJSON(webauthn_test_server_1.TEST_RP_ORIGIN, reg);
+            return server.getRegistrationVerification(user, regResp).then(async () => {
+                const req = await server.getAuthenticationOptions();
+                const call = () => emulator.getJSON(webauthn_test_server_1.TEST_RP_ORIGIN, req);
+                (0, globals_1.expect)(call).toThrow(DOMException);
+                try {
+                    call();
+                    throw new Error("Expected DOMException");
+                }
+                catch (e) {
+                    (0, globals_1.expect)(e).toBeInstanceOf(DOMException);
+                    (0, globals_1.expect)(e.name).toBe("DataError");
+                }
+            });
+        });
+    });
+});
+(0, globals_1.describe)("handleAuthenticatorCall other error path", () => {
+    (0, globals_1.test)("getAuthenticatorInfo rethrows non-CTAP errors as-is", () => {
+        class ThrowingAuthenticator extends src_1.AuthenticatorEmulator {
+            command() {
+                throw new Error("Non-CTAP failure");
+            }
+        }
+        const emulator = new src_1.default(new ThrowingAuthenticator());
+        try {
+            emulator.getAuthenticatorInfo();
+            throw new Error("Expected Error to be thrown");
+        }
+        catch (e) {
+            // Should not be mapped to DOMException; should be the original error
+            (0, globals_1.expect)(e).not.toBeInstanceOf(DOMException);
+            (0, globals_1.expect)(e).toBeInstanceOf(Error);
+            (0, globals_1.expect)(e.message).toBe("Non-CTAP failure");
+        }
+    });
+});

package/dist/src/authenticator/authenticator-emulator.d.ts

@@ -19,7 +19,7 @@ export type PasskeyCredential = {
     readonly user: PublicKeyCredentialUserEntity | undefined;
 };
 export type AuthenticatorParameters = {
-    readonly aaguid: Uint8Array;
+    readonly aaguid: Uint8Array<ArrayBuffer>;
     readonly transports: AuthenticatorTransport[];
     readonly algorithmIdentifiers: readonly (keyof typeof COSEAlgorithmIdentifier)[];
     readonly signCounterIncrement: number;

package/dist/src/authenticator/authenticator-emulator.js

@@ -353,7 +353,7 @@ function getAssertion(rpIdHash, clientDataHash, newSignCounter, credential, inte
         type: "pkcs8",
         key: credential.privateKey,
     });
-    const signature = (0, node_crypto_1.sign)(null, new Uint8Array(payload), privateKey);
+    const signature = encode_utils_1.default.bufferSourceToUint8Array(new Uint8Array((0, node_crypto_1.sign)(null, new Uint8Array(payload), privateKey)));
     return { authData: (0, webauthn_model_1.packAuthenticatorData)(authenticatorData), signature };
 }
 function makeCredential(aaguid, rpId, alg, transports, interactionResponse, user, statelessKey) {

package/dist/src/authenticator/ctap-model.d.ts

@@ -9,7 +9,7 @@ export type AuthenticatorInteractionOptions = {
 };
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential */
 export interface AuthenticatorMakeCredentialRequest {
-    clientDataHash: Uint8Array;
+    clientDataHash: Uint8Array<ArrayBuffer>;
     rp: PublicKeyCredentialRpEntity & {
         id: string;
     };
@@ -18,30 +18,30 @@ export interface AuthenticatorMakeCredentialRequest {
     excludeList?: PublicKeyCredentialDescriptor[];
     extensions?: object;
     options?: Partial<AuthenticatorOptions>;
-    pinAuth?: Uint8Array;
+    pinAuth?: Uint8Array<ArrayBuffer>;
     pinProtocol?: number;
 }
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential */
 export interface AuthenticatorMakeCredentialResponse {
     fmt: string;
-    authData: Uint8Array;
+    authData: Uint8Array<ArrayBuffer>;
     attStmt: object;
 }
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion */
 export interface AuthenticatorGetAssertionRequest {
     rpId: string;
-    clientDataHash: Uint8Array;
+    clientDataHash: Uint8Array<ArrayBuffer>;
     allowList?: PublicKeyCredentialDescriptor[];
     extensions?: object;
     options?: Partial<AuthenticatorOptions>;
-    pinAuth?: Uint8Array;
+    pinAuth?: Uint8Array<ArrayBuffer>;
     pinProtocol?: number;
 }
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion */
 export interface AuthenticatorGetAssertionResponse {
     credential?: PublicKeyCredentialDescriptor;
-    authData: Uint8Array;
-    signature: Uint8Array;
+    authData: Uint8Array<ArrayBuffer>;
+    signature: Uint8Array<ArrayBuffer>;
     user?: PublicKeyCredentialUserEntity;
     numberOfCredentials: number;
 }
@@ -49,7 +49,7 @@ export interface AuthenticatorGetAssertionResponse {
 export type AuthenticatorGetInfoResponse = {
     versions: string[];
     extensions?: string[];
-    aaguid: Uint8Array;
+    aaguid: Uint8Array<ArrayBuffer>;
     options?: Partial<AuthenticatorOptions> & {
         plat?: boolean;
         clientPin?: boolean;
@@ -91,35 +91,35 @@ export declare enum CREDENTIAL_MANAGEMENT_SUBCOMMAND {
 export interface AuthenticatorCredentialManagementRequest {
     subCommand: CREDENTIAL_MANAGEMENT_SUBCOMMAND;
     subCommandParams?: {
-        credentialId?: Uint8Array;
+        credentialId?: Uint8Array<ArrayBuffer>;
         rpId?: string;
         user?: PublicKeyCredentialUserEntity;
     };
     pinUvAuthProtocol?: number;
-    pinUvAuthParam?: Uint8Array;
+    pinUvAuthParam?: Uint8Array<ArrayBuffer>;
 }
 export interface AuthenticatorCredentialManagementResponse {
     existingResidentCredentialsCount?: number;
     maxPossibleRemainingResidentCredentialsCount?: number;
     rp?: PublicKeyCredentialRpEntity;
-    rpIDHash?: Uint8Array;
+    rpIDHash?: Uint8Array<ArrayBuffer>;
     totalRPs?: number;
     user?: PublicKeyCredentialUserEntity;
-    credentialID?: Uint8Array;
-    publicKey?: Uint8Array;
+    credentialID?: Uint8Array<ArrayBuffer>;
+    publicKey?: Uint8Array<ArrayBuffer>;
     totalCredentials?: number;
     credProtect?: number;
-    largeBlobKey?: Uint8Array;
+    largeBlobKey?: Uint8Array<ArrayBuffer>;
 }
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses */
 export interface CTAPAuthenticatorResponse {
     status: CTAP_STATUS_CODE;
-    data?: Uint8Array;
+    data?: Uint8Array<ArrayBuffer>;
 }
 /** @see https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#commands */
 export interface CTAPAuthenticatorRequest {
     command: CTAP_COMMAND;
-    data?: Uint8Array;
+    data?: Uint8Array<ArrayBuffer>;
 }
 export declare class AuthenticationEmulatorError extends Error {
     status: CTAP_STATUS_CODE;

package/dist/src/libs/encode-utils.d.ts

@@ -1,9 +1,9 @@
 declare function encodeBase64Url(data: BufferSource): string;
-declare function decodeBase64Url(base64Url: string): Uint8Array;
-declare function bufferSourceToUint8Array(data: BufferSource): Uint8Array;
-declare function strToUint8Array(data: string): Uint8Array;
-declare function encodeCbor(data: object): Uint8Array;
-declare function decodeCbor<T>(data: Uint8Array): T;
+declare function decodeBase64Url(base64Url: string): Uint8Array<ArrayBuffer>;
+declare function bufferSourceToUint8Array(data: BufferSource): Uint8Array<ArrayBuffer>;
+declare function strToUint8Array(data: string): Uint8Array<ArrayBuffer>;
+declare function encodeCbor(data: object): Uint8Array<ArrayBuffer>;
+declare function decodeCbor<T>(data: Uint8Array<ArrayBuffer>): T;
 declare const EncodeUtils: {
     strToUint8Array: typeof strToUint8Array;
     bufferSourceToUint8Array: typeof bufferSourceToUint8Array;

package/dist/src/libs/encode-utils.js

@@ -31,7 +31,13 @@ function strToUint8Array(data) {
 }
 function encodeCbor(data) {
     function encoder(value) {
-        if (value instanceof Uint8Array || value instanceof ArrayBuffer) {
+        if (value instanceof Buffer) {
+            return value;
+        }
+        if (value instanceof Uint8Array) {
+            return Buffer.from(value);
+        }
+        if (value instanceof ArrayBuffer) {
             return Buffer.from(value);
         }
         if (Array.isArray(value)) {

package/dist/src/webauthn/cose-key.d.ts

@@ -4,13 +4,13 @@ export declare abstract class CoseKey {
     kty: number;
     alg: number;
     constructor(kty: number, alg: number);
-    abstract toBytes(): Uint8Array;
+    abstract toBytes(): Uint8Array<ArrayBuffer>;
     abstract toJwk(): JsonWebKey;
     toKeyObject(): KeyObject;
     static fromKeyObject(keyObject: KeyObject): CoseKey;
-    toDer(): Uint8Array;
-    static fromDer(der: Uint8Array): CoseKey;
+    toDer(): Uint8Array<ArrayBuffer>;
+    static fromDer(der: Uint8Array<ArrayBuffer>): CoseKey;
     equals(other: CoseKey): boolean;
-    static fromBytes(bytes: Uint8Array): CoseKey;
+    static fromBytes(bytes: Uint8Array<ArrayBuffer>): CoseKey;
     static fromJwk(jwk: JsonWebKey): CoseKey;
 }

package/dist/src/webauthn/cose-key.js

@@ -21,7 +21,7 @@ class CoseKey {
         return CoseKey.fromJwk(keyObject.export({ format: "jwk" }));
     }
     toDer() {
-        return this.toKeyObject().export({ format: "der", type: "spki" });
+        return new Uint8Array(this.toKeyObject().export({ format: "der", type: "spki" }));
     }
     static fromDer(der) {
         return CoseKey.fromKeyObject(node_crypto_1.default.createPublicKey({ format: "der", type: "spki", key: Buffer.from(der) }));

package/dist/src/webauthn/webauthn-emulator.d.ts

@@ -10,16 +10,14 @@ export type AuthenticatorInfo = {
 };
 export declare class WebAuthnEmulatorError extends Error {
 }
-export declare class NoPublicKeyError extends WebAuthnEmulatorError {
-}
-export declare class InvalidRpIdError extends WebAuthnEmulatorError {
-}
 /**
  * WebAuthn emulator
  */
 export declare class WebAuthnEmulator {
     authenticator: AuthenticatorEmulator;
     constructor(authenticator?: AuthenticatorEmulator);
+    private mapAuthenticatorErrorToDOMException;
+    private handleAuthenticatorCall;
     getJSON(origin: string, optionsJSON: PublicKeyCredentialRequestOptionsJSON, relatedOrigins?: string[]): AuthenticationResponseJSON;
     createJSON(origin: string, optionsJSON: PublicKeyCredentialCreationOptionsJSON, relatedOrigins?: string[]): RegistrationResponseJSON;
     getAuthenticatorInfo(): AuthenticatorInfo;

package/dist/src/webauthn/webauthn-emulator.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebAuthnEmulator = exports.InvalidRpIdError = exports.NoPublicKeyError = exports.WebAuthnEmulatorError = void 0;
+exports.WebAuthnEmulator = exports.WebAuthnEmulatorError = void 0;
 const node_crypto_1 = require("node:crypto");
 const authenticator_emulator_1 = require("../authenticator/authenticator-emulator");
 const ctap_model_1 = require("../authenticator/ctap-model");
@@ -13,12 +13,6 @@ const webauthn_model_json_1 = require("./webauthn-model-json");
 class WebAuthnEmulatorError extends Error {
 }
 exports.WebAuthnEmulatorError = WebAuthnEmulatorError;
-class NoPublicKeyError extends WebAuthnEmulatorError {
-}
-exports.NoPublicKeyError = NoPublicKeyError;
-class InvalidRpIdError extends WebAuthnEmulatorError {
-}
-exports.InvalidRpIdError = InvalidRpIdError;
 /**
  * WebAuthn emulator
  */
@@ -27,6 +21,41 @@ class WebAuthnEmulator {
     constructor(authenticator = new authenticator_emulator_1.AuthenticatorEmulator()) {
         this.authenticator = authenticator;
     }
+    mapAuthenticatorErrorToDOMException(error) {
+        let name;
+        switch (error.status) {
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_CREDENTIAL_EXCLUDED:
+                name = "NotAllowedError";
+                break;
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_UNSUPPORTED_ALGORITHM:
+                name = "NotSupportedError";
+                break;
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_OPERATION_DENIED:
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED:
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS:
+                name = "NotAllowedError";
+                break;
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER:
+            case ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_INVALID_CBOR:
+                name = "DataError";
+                break;
+            default:
+                name = "UnknownError";
+                break;
+        }
+        return new DOMException(error.message, name);
+    }
+    handleAuthenticatorCall(fn) {
+        try {
+            return fn();
+        }
+        catch (error) {
+            if (error instanceof ctap_model_1.AuthenticationEmulatorError) {
+                throw this.mapAuthenticatorErrorToDOMException(error);
+            }
+            throw error;
+        }
+    }
     getJSON(origin, optionsJSON, relatedOrigins = []) {
         const options = (0, webauthn_model_json_1.parseRequestOptionsFromJSON)(optionsJSON);
         const response = this.get(origin, { publicKey: options }, relatedOrigins);
@@ -38,7 +67,7 @@ class WebAuthnEmulator {
         return response.toJSON();
     }
     getAuthenticatorInfo() {
-        const authenticatorInfo = (0, ctap_model_1.unpackGetInfoResponse)(this.authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorGetInfo }));
+        const authenticatorInfo = this.handleAuthenticatorCall(() => (0, ctap_model_1.unpackGetInfoResponse)(this.authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorGetInfo })));
         return {
             version: authenticatorInfo.versions.join(", "),
             aaguid: encode_utils_1.default.encodeBase64Url(authenticatorInfo.aaguid),
@@ -50,13 +79,13 @@ class WebAuthnEmulator {
     }
     signalUnknownCredential(options) {
         const credentialId = (0, webauthn_model_json_1.decodeBase64Url)(options.credentialId);
-        this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
+        this.handleAuthenticatorCall(() => this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
             subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential,
             subCommandParams: {
                 credentialId: encode_utils_1.default.bufferSourceToUint8Array(credentialId),
                 rpId: options.rpId,
             },
-        }));
+        })));
     }
     /**
      * Signal all accepted credentials for a user
@@ -66,12 +95,12 @@ class WebAuthnEmulator {
         // Create a set of accepted credential IDs for quick lookup
         const acceptedCredentialIds = new Set(options.allAcceptedCredentialIds);
         // Start enumerating credentials for the specified RP
-        const beginResponse = (0, ctap_model_1.unpackCredentialManagementResponse)(this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
+        const beginResponse = this.handleAuthenticatorCall(() => (0, ctap_model_1.unpackCredentialManagementResponse)(this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
             subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
             subCommandParams: {
                 rpId: options.rpId,
             },
-        })));
+        }))));
         // Get the total number of credentials
         const totalCredentials = beginResponse.totalCredentials ?? 0;
         // Get all credentials for the RP and delete those not in the accepted list
@@ -84,9 +113,9 @@ class WebAuthnEmulator {
         // Process each credential
         for (let i = 0; i < totalCredentials; i++) {
             // Get next credential and unpack the response
-            const credResponse = (0, ctap_model_1.unpackCredentialManagementResponse)(this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
+            const credResponse = this.handleAuthenticatorCall(() => (0, ctap_model_1.unpackCredentialManagementResponse)(this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsGetNextCredential,
-            })));
+            }))));
             // Skip if this is not for the user we're looking for
             if (credResponse.user && encode_utils_1.default.encodeBase64Url(credResponse.user.id) !== userId) {
                 continue;
@@ -96,13 +125,13 @@ class WebAuthnEmulator {
                 const credentialId = encode_utils_1.default.encodeBase64Url(credResponse.credentialID);
                 if (!acceptedCredentialIds.has(credentialId)) {
                     // Delete the credential directly
-                    this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
+                    this.handleAuthenticatorCall(() => this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
                         subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential,
                         subCommandParams: {
                             credentialId: credResponse.credentialID,
                             rpId: rpId,
                         },
-                    }));
+                    })));
                 }
             }
         }
@@ -120,21 +149,21 @@ class WebAuthnEmulator {
             displayName: options.displayName,
         };
         // Update user information using the credential management API
-        this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
+        this.handleAuthenticatorCall(() => this.authenticator.command((0, ctap_model_1.packCredentialManagementRequest)({
             subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
             subCommandParams: {
                 rpId: options.rpId,
                 user: user,
             },
-        }));
+        })));
     }
     /** @see https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get */
     get(origin, options, relatedOrigins = []) {
         if (!options.publicKey)
-            throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
+            throw new TypeError("PublicKeyCredentialRequestOptions are required");
         const rpId = new webauthn_model_1.RpId(options.publicKey.rpId ?? new URL(origin).hostname);
         if (!rpId.validate(origin, relatedOrigins))
-            throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
+            throw new DOMException(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`, "SecurityError");
         const clientData = {
             type: "webauthn.get",
             challenge: encode_utils_1.default.encodeBase64Url(options.publicKey.challenge),
@@ -143,24 +172,24 @@ class WebAuthnEmulator {
         };
         const authenticatorRequest = (0, ctap_model_1.packGetAssertionRequest)({
             rpId: rpId.value,
-            clientDataHash: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(clientData)).digest(),
+            clientDataHash: encode_utils_1.default.bufferSourceToUint8Array(new Uint8Array((0, node_crypto_1.createHash)("sha256").update(JSON.stringify(clientData)).digest())),
             allowList: options.publicKey.allowCredentials,
             options: (0, webauthn_model_1.toFido2RequestOptions)(options.publicKey.userVerification),
         });
-        const authenticatorResponse = (0, ctap_model_1.unpackGetAssertionResponse)(this.authenticator.command(authenticatorRequest));
+        const authenticatorResponse = this.handleAuthenticatorCall(() => (0, ctap_model_1.unpackGetAssertionResponse)(this.authenticator.command(authenticatorRequest)));
         const responseId = authenticatorResponse.credential?.id ?? options.publicKey.allowCredentials?.[0]?.id;
         const authData = (0, webauthn_model_1.unpackAuthenticatorData)(authenticatorResponse.authData);
         const rawId = encode_utils_1.default.bufferSourceToUint8Array(responseId);
         const publicKeyCredential = {
             id: encode_utils_1.default.encodeBase64Url(rawId),
             type: "public-key",
-            rawId,
+            rawId: rawId.buffer,
             response: {
-                clientDataJSON: encode_utils_1.default.strToUint8Array(JSON.stringify(clientData)),
-                authenticatorData: (0, webauthn_model_1.packAuthenticatorData)(authData),
-                signature: authenticatorResponse.signature,
+                clientDataJSON: encode_utils_1.default.strToUint8Array(JSON.stringify(clientData)).buffer,
+                authenticatorData: (0, webauthn_model_1.packAuthenticatorData)(authData).buffer,
+                signature: authenticatorResponse.signature.buffer,
                 userHandle: authenticatorResponse.user
-                    ? encode_utils_1.default.bufferSourceToUint8Array(authenticatorResponse.user.id)
+                    ? encode_utils_1.default.bufferSourceToUint8Array(authenticatorResponse.user.id).buffer
                     : null,
             },
             authenticatorAttachment: null,
@@ -172,10 +201,10 @@ class WebAuthnEmulator {
     /** @see https://developer.mozilla.org/ja/docs/Web/API/CredentialsContainer/create */
     create(origin, options, relatedOrigins = []) {
         if (!options.publicKey)
-            throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
+            throw new TypeError("PublicKeyCredentialCreationOptions are required");
         const rpId = new webauthn_model_1.RpId(options.publicKey.rp.id ?? new URL(origin).hostname);
         if (!rpId.validate(origin, relatedOrigins))
-            throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
+            throw new DOMException(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`, "SecurityError");
         const clientData = {
             challenge: encode_utils_1.default.encodeBase64Url(options.publicKey.challenge),
             origin,
@@ -184,14 +213,14 @@ class WebAuthnEmulator {
         };
         const clientDataJSON = JSON.stringify(clientData);
         const authenticatorRequest = (0, ctap_model_1.packMakeCredentialRequest)({
-            clientDataHash: encode_utils_1.default.bufferSourceToUint8Array((0, node_crypto_1.createHash)("sha256").update(clientDataJSON).digest()),
+            clientDataHash: encode_utils_1.default.bufferSourceToUint8Array(new Uint8Array((0, node_crypto_1.createHash)("sha256").update(clientDataJSON).digest())),
             rp: { name: options.publicKey.rp.name, id: rpId.value },
             user: options.publicKey.user,
             pubKeyCredParams: options.publicKey.pubKeyCredParams,
             excludeList: options.publicKey.excludeCredentials,
             options: (0, webauthn_model_1.toFido2CreateOptions)(options.publicKey.authenticatorSelection),
         });
-        const authenticatorResponse = (0, ctap_model_1.unpackMakeCredentialResponse)(this.authenticator.command(authenticatorRequest));
+        const authenticatorResponse = this.handleAuthenticatorCall(() => (0, ctap_model_1.unpackMakeCredentialResponse)(this.authenticator.command(authenticatorRequest)));
         const authData = (0, webauthn_model_1.unpackAuthenticatorData)(authenticatorResponse.authData);
         const attestedCredentialData = authData.attestedCredentialData;
         const attestationObject = {
@@ -200,17 +229,17 @@ class WebAuthnEmulator {
             authData,
         };
         const response = {
-            attestationObject: (0, webauthn_model_1.packAttestationObject)(attestationObject),
-            clientDataJSON: encode_utils_1.default.strToUint8Array(clientDataJSON),
-            getAuthenticatorData: () => (0, webauthn_model_1.packAuthenticatorData)(authData),
-            getPublicKey: () => attestedCredentialData.credentialPublicKey.toDer(),
+            attestationObject: (0, webauthn_model_1.packAttestationObject)(attestationObject).buffer,
+            clientDataJSON: encode_utils_1.default.strToUint8Array(clientDataJSON).buffer,
+            getAuthenticatorData: () => (0, webauthn_model_1.packAuthenticatorData)(authData).buffer,
+            getPublicKey: () => attestedCredentialData.credentialPublicKey.toDer().buffer,
             getPublicKeyAlgorithm: () => attestedCredentialData.credentialPublicKey.alg,
             getTransports: () => this.authenticator.params.transports,
         };
         const publicKeyCredential = {
             id: encode_utils_1.default.encodeBase64Url(attestedCredentialData.credentialId),
             type: "public-key",
-            rawId: attestedCredentialData.credentialId,
+            rawId: attestedCredentialData.credentialId.buffer,
             response,
             authenticatorAttachment: null,
             getClientExtensionResults: () => ({ credProps: { rk: true } }),

package/dist/src/webauthn/webauthn-model.d.ts

@@ -3,27 +3,27 @@ import { CoseKey } from "./cose-key";
 export declare class RpId {
     readonly value: string;
     constructor(value: string);
-    get hash(): Uint8Array;
+    get hash(): Uint8Array<ArrayBuffer>;
     /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
     validate(origin: string, relatedOrigins?: string[]): boolean;
 }
 /** @see https://www.w3.org/TR/webauthn-3/#public-key-credential-source */
 export type PublicKeyCredentialSource = {
     type: "public-key";
-    id: Uint8Array;
-    privateKey: Uint8Array;
+    id: Uint8Array<ArrayBuffer>;
+    privateKey: Uint8Array<ArrayBuffer>;
     rpId: RpId;
-    userHandle?: Uint8Array;
+    userHandle?: Uint8Array<ArrayBuffer>;
 };
 /** @see https://www.w3.org/TR/webauthn-3/#sctn-attested-credential-data */
 export type AttestedCredentialData = {
-    aaguid: Uint8Array;
-    credentialId: Uint8Array;
+    aaguid: Uint8Array<ArrayBuffer>;
+    credentialId: Uint8Array<ArrayBuffer>;
     credentialPublicKey: CoseKey;
 };
 /** @see https://www.w3.org/TR/webauthn-3/#sctn-authenticator-data */
 export type AuthenticatorData = {
-    rpIdHash: Uint8Array;
+    rpIdHash: Uint8Array<ArrayBuffer>;
     flags: {
         userPresent?: boolean;
         userVerified?: boolean;
@@ -49,10 +49,10 @@ export type CollectedClientData = {
     origin: string;
     crossOrigin: boolean;
 };
-export declare function packAttestationObject(attestationObject: AttestationObject): Uint8Array;
-export declare function packAuthenticatorData(authData: AuthenticatorData): Uint8Array;
-export declare function unpackAttestationObject(attestationObject: Uint8Array): AttestationObject;
-export declare function unpackAuthenticatorData(authData: Uint8Array): AuthenticatorData;
+export declare function packAttestationObject(attestationObject: AttestationObject): Uint8Array<ArrayBuffer>;
+export declare function packAuthenticatorData(authData: AuthenticatorData): Uint8Array<ArrayBuffer>;
+export declare function unpackAttestationObject(attestationObject: Uint8Array<ArrayBuffer>): AttestationObject;
+export declare function unpackAuthenticatorData(authData: Uint8Array<ArrayBuffer>): AuthenticatorData;
 export type PublicKeyCredentialSourceJSON = {
     type: "public-key";
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nid-webauthn-emulator",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "keywords": [
     "test",
     "e2e",
@@ -15,19 +15,19 @@
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "devDependencies": {
-    "@biomejs/biome": "^2.1.2",
-    "@jest/globals": "^30.0.4",
-    "@simplewebauthn/server": "^13.1.2",
+    "@biomejs/biome": "^2.2.4",
+    "@jest/globals": "^30.2.0",
+    "@simplewebauthn/server": "^13.2.1",
     "@tsconfig/recommended": "^1.0.10",
-    "@types/node": "^24.2.0",
-    "jest": "^30.0.5",
-    "ts-jest": "^29.4.1",
+    "@types/node": "^24.5.2",
+    "jest": "^30.2.0",
+    "ts-jest": "^29.4.4",
     "ts-node": "^10.9.2",
-    "typescript": "^5.8.3"
+    "typescript": "^5.9.2"
   },
   "dependencies": {
-    "cbor": "^10.0.10",
-    "tldts": "^7.0.10"
+    "cbor": "^10.0.11",
+    "tldts": "^7.0.16"
   },
   "scripts": {
     "check": "biome check .",