wherdr 0.0.0-stage → 1.2.0

package/.output/server/node_modules/@peculiar/x509/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@peculiar/x509",
+  "version": "1.14.3",
+  "description": "@peculiar/x509 is an easy to use TypeScript/Javascript library based on @peculiar/asn1-schema that makes generating X.509 Certificates and Certificate Requests as well as validating certificate chains easy",
+  "main": "build/x509.cjs.js",
+  "module": "build/x509.es.js",
+  "unpkg": "build/x509.js",
+  "types": "build/index.d.ts",
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
+    "build": "npm run build:module",
+    "build:module": "rollup -c",
+    "rebuild": "npm run clear && npm run build",
+    "coverage": "vitest run --coverage",
+    "coveralls": "vitest run --coverage && cat coverage/lcov.info | coveralls",
+    "pub": "npm run pub:patch",
+    "pub:patch": "npm version patch && npm run git:push",
+    "pub:minor": "npm version minor && npm run git:push",
+    "pub:major": "npm version major && npm run git:push",
+    "git:push": "git push --follow-tags"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PeculiarVentures/x509.git"
+  },
+  "keywords": [
+    "x509",
+    "certificate",
+    "csr",
+    "pkcs10",
+    "pkcs7",
+    "cms",
+    "rsa",
+    "ec"
+  ],
+  "author": "Peculiar Ventures LLC",
+  "contributors": [
+    "Miroshin Stepan<microshine@mail.ru>"
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/PeculiarVentures/x509/issues"
+  },
+  "homepage": "https://github.com/PeculiarVentures/x509#readme",
+  "files": [
+    "build/**/*.{ts,js}",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "@babel/core": "^7.28.5",
+    "@babel/preset-env": "^7.28.5",
+    "@peculiar/eslint-config-base": "^0.2.8",
+    "@peculiar/webcrypto": "^1.5.0",
+    "@rollup/plugin-babel": "^6.1.0",
+    "@rollup/plugin-commonjs": "^29.0.0",
+    "@rollup/plugin-node-resolve": "^16.0.3",
+    "@rollup/plugin-terser": "^0.4.4",
+    "@types/node": "^24.10.1",
+    "@vitest/coverage-v8": "^4.0.9",
+    "rimraf": "^6.1.0",
+    "rollup": "^4.53.2",
+    "rollup-plugin-dts": "^6.2.3",
+    "rollup-plugin-typescript2": "^0.36.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.9"
+  },
+  "dependencies": {
+    "@peculiar/asn1-cms": "^2.6.0",
+    "@peculiar/asn1-csr": "^2.6.0",
+    "@peculiar/asn1-ecc": "^2.6.0",
+    "@peculiar/asn1-pkcs9": "^2.6.0",
+    "@peculiar/asn1-rsa": "^2.6.0",
+    "@peculiar/asn1-schema": "^2.6.0",
+    "@peculiar/asn1-x509": "^2.6.0",
+    "pvtsutils": "^1.3.6",
+    "reflect-metadata": "^0.2.2",
+    "tslib": "^2.8.1",
+    "tsyringe": "^4.10.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=10",
+      "onFail": "error"
+    }
+  }
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/authentication/generateAuthenticationOptions.js

@@ -0,0 +1,41 @@
+import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+import { generateChallenge } from '../helpers/generateChallenge.js';
+/**
+ * Prepare a value to pass into navigator.credentials.get(...) for authenticator authentication
+ *
+ * **Options:**
+ *
+ * @param rpID - Valid domain name (after `https://`)
+ * @param allowCredentials **(Optional)** - Authenticators previously registered by the user, if any. If undefined the client will ask the user which credential they want to use
+ * @param challenge **(Optional)** - Random value the authenticator needs to sign and pass back user for authentication. Defaults to generating a random value
+ * @param timeout **(Optional)** - How long (in ms) the user can take to complete authentication. Defaults to `60000`
+ * @param userVerification **(Optional)** - Set to `'discouraged'` when asserting as part of a 2FA flow, otherwise set to `'preferred'` or `'required'` as desired. Defaults to `"preferred"`
+ * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during authentication
+ */
+export async function generateAuthenticationOptions(options) {
+    const { allowCredentials, challenge = await generateChallenge(), timeout = 60000, userVerification = 'preferred', extensions, rpID, } = options;
+    /**
+     * Preserve ability to specify `string` values for challenges
+     */
+    let _challenge = challenge;
+    if (typeof _challenge === 'string') {
+        _challenge = isoUint8Array.fromUTF8String(_challenge);
+    }
+    return {
+        rpId: rpID,
+        challenge: isoBase64URL.fromBuffer(_challenge),
+        allowCredentials: allowCredentials?.map((cred) => {
+            if (!isoBase64URL.isBase64URL(cred.id)) {
+                throw new Error(`allowCredential id "${cred.id}" is not a valid base64url string`);
+            }
+            return {
+                ...cred,
+                id: isoBase64URL.trimPadding(cred.id),
+                type: 'public-key',
+            };
+        }),
+        timeout,
+        userVerification,
+        extensions,
+    };
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/authentication/verifyAuthenticationResponse.js

@@ -0,0 +1,171 @@
+import { decodeClientDataJSON } from '../helpers/decodeClientDataJSON.js';
+import { toHash } from '../helpers/toHash.js';
+import { verifySignature } from '../helpers/verifySignature.js';
+import { parseAuthenticatorData } from '../helpers/parseAuthenticatorData.js';
+import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
+import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
+import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+/**
+ * Verify that the user has legitimately completed the authentication process
+ *
+ * **Options:**
+ *
+ * @param response - Response returned by **@simplewebauthn/browser**'s `startAuthentication()`
+ * @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
+ * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
+ * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
+ * @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
+ * @param expectedType **(Optional)** - The response type expected ('webauthn.get')
+ * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
+ * @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements
+ * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
+ */
+export async function verifyAuthenticationResponse(options) {
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { id, rawId, type: credentialType, response: assertionResponse } = response;
+    // Ensure credential specified an ID
+    if (!id) {
+        throw new Error('Missing credential ID');
+    }
+    // Ensure ID is base64url-encoded
+    if (id !== rawId) {
+        throw new Error('Credential ID was not base64url-encoded');
+    }
+    // Make sure credential type is public-key
+    if (credentialType !== 'public-key') {
+        throw new Error(`Unexpected credential type ${credentialType}, expected "public-key"`);
+    }
+    if (!response) {
+        throw new Error('Credential missing response');
+    }
+    if (typeof assertionResponse?.clientDataJSON !== 'string') {
+        throw new Error('Credential response clientDataJSON was not a string');
+    }
+    const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
+    const { type, origin, challenge, tokenBinding } = clientDataJSON;
+    // Make sure we're handling an authentication
+    if (Array.isArray(expectedType)) {
+        if (!expectedType.includes(type)) {
+            const joinedExpectedType = expectedType.join(', ');
+            throw new Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`);
+        }
+    }
+    else if (expectedType) {
+        if (type !== expectedType) {
+            throw new Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`);
+        }
+    }
+    else if (type !== 'webauthn.get') {
+        throw new Error(`Unexpected authentication response type: ${type}`);
+    }
+    // Ensure the device provided the challenge we gave it
+    if (typeof expectedChallenge === 'function') {
+        if (!(await expectedChallenge(challenge))) {
+            throw new Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`);
+        }
+    }
+    else if (challenge !== expectedChallenge) {
+        throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
+    }
+    // Check that the origin is our site
+    if (Array.isArray(expectedOrigin)) {
+        if (!expectedOrigin.includes(origin)) {
+            const joinedExpectedOrigin = expectedOrigin.join(', ');
+            throw new Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`);
+        }
+    }
+    else {
+        if (origin !== expectedOrigin) {
+            throw new Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);
+        }
+    }
+    if (!isoBase64URL.isBase64URL(assertionResponse.authenticatorData)) {
+        throw new Error('Credential response authenticatorData was not a base64url string');
+    }
+    if (!isoBase64URL.isBase64URL(assertionResponse.signature)) {
+        throw new Error('Credential response signature was not a base64url string');
+    }
+    if (assertionResponse.userHandle &&
+        typeof assertionResponse.userHandle !== 'string') {
+        throw new Error('Credential response userHandle was not a string');
+    }
+    if (tokenBinding) {
+        if (typeof tokenBinding !== 'object') {
+            throw new Error('ClientDataJSON tokenBinding was not an object');
+        }
+        if (['present', 'supported', 'notSupported'].indexOf(tokenBinding.status) < 0) {
+            throw new Error(`Unexpected tokenBinding status ${tokenBinding.status}`);
+        }
+    }
+    const authDataBuffer = isoBase64URL.toBuffer(assertionResponse.authenticatorData);
+    const parsedAuthData = parseAuthenticatorData(authDataBuffer);
+    const { rpIdHash, flags, counter, extensionsData } = parsedAuthData;
+    // Make sure the response's RP ID is ours
+    let expectedRPIDs = [];
+    if (typeof expectedRPID === 'string') {
+        expectedRPIDs = [expectedRPID];
+    }
+    else {
+        expectedRPIDs = expectedRPID;
+    }
+    const matchedRPID = await matchExpectedRPID(rpIdHash, expectedRPIDs);
+    if (advancedFIDOConfig !== undefined) {
+        const { userVerification: fidoUserVerification } = advancedFIDOConfig;
+        /**
+         * Use FIDO Conformance-defined rules for verifying UP and UV flags
+         */
+        if (fidoUserVerification === 'required') {
+            // Require `flags.uv` be true (implies `flags.up` is true)
+            if (!flags.uv) {
+                throw new Error('User verification required, but user could not be verified');
+            }
+        }
+        else if (fidoUserVerification === 'preferred' ||
+            fidoUserVerification === 'discouraged') {
+            // Ignore `flags.uv`
+        }
+    }
+    else {
+        /**
+         * Use WebAuthn spec-defined rules for verifying UP and UV flags
+         */
+        // WebAuthn only requires the user presence flag be true
+        if (!flags.up) {
+            throw new Error('User not present during authentication');
+        }
+        // Enforce user verification if required
+        if (requireUserVerification && !flags.uv) {
+            throw new Error('User verification required, but user could not be verified');
+        }
+    }
+    const clientDataHash = await toHash(isoBase64URL.toBuffer(assertionResponse.clientDataJSON));
+    const signatureBase = isoUint8Array.concat([authDataBuffer, clientDataHash]);
+    const signature = isoBase64URL.toBuffer(assertionResponse.signature);
+    if ((counter > 0 || credential.counter > 0) &&
+        counter <= credential.counter) {
+        // Error out when the counter in the DB is greater than or equal to the counter in the
+        // dataStruct. It's related to how the authenticator maintains the number of times its been
+        // used for this client. If this happens, then someone's somehow increased the counter
+        // on the device without going through this site
+        throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
+    }
+    const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
+    const toReturn = {
+        verified: await verifySignature({
+            signature,
+            data: signatureBase,
+            credentialPublicKey: credential.publicKey,
+        }),
+        authenticationInfo: {
+            newCounter: counter,
+            credentialID: credential.id,
+            userVerified: flags.uv,
+            credentialDeviceType,
+            credentialBackedUp,
+            authenticatorExtensionResults: extensionsData,
+            origin: clientDataJSON.origin,
+            rpID: matchedRPID,
+        },
+    };
+    return toReturn;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/convertAAGUIDToString.js

@@ -0,0 +1,17 @@
+import { isoUint8Array } from './iso/index.js';
+/**
+ * Convert the aaguid buffer in authData into a UUID string
+ */
+export function convertAAGUIDToString(aaguid) {
+    // Raw Hex: adce000235bcc60a648b0b25f1f05503
+    const hex = isoUint8Array.toHex(aaguid);
+    const segments = [
+        hex.slice(0, 8), // 8
+        hex.slice(8, 12), // 4
+        hex.slice(12, 16), // 4
+        hex.slice(16, 20), // 4
+        hex.slice(20, 32), // 8
+    ];
+    // Formatted: adce0002-35bc-c60a-648b-0b25f1f05503
+    return segments.join('-');
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/convertCOSEtoPKCS.js

@@ -0,0 +1,21 @@
+import { isoCBOR, isoUint8Array } from './iso/index.js';
+import { COSEKEYS } from './cose.js';
+/**
+ * Takes COSE-encoded public key and converts it to PKCS key
+ */
+export function convertCOSEtoPKCS(cosePublicKey) {
+    // This is a little sloppy, I'm using COSEPublicKeyEC2 since it could have both x and y, but when
+    // there's no y it means it's probably better typed as COSEPublicKeyOKP. I'll leave this for now
+    // and revisit it later if it ever becomes an actual problem.
+    const struct = isoCBOR.decodeFirst(cosePublicKey);
+    const tag = Uint8Array.from([0x04]);
+    const x = struct.get(COSEKEYS.x);
+    const y = struct.get(COSEKEYS.y);
+    if (!x) {
+        throw new Error('COSE public key was missing x');
+    }
+    if (y) {
+        return isoUint8Array.concat([tag, x, y]);
+    }
+    return isoUint8Array.concat([tag, x]);
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/convertCertBufferToPEM.js

@@ -0,0 +1,31 @@
+import { isoBase64URL } from './iso/index.js';
+/**
+ * Convert buffer to an OpenSSL-compatible PEM text format.
+ */
+export function convertCertBufferToPEM(certBuffer) {
+    let b64cert;
+    /**
+     * Get certBuffer to a base64 representation
+     */
+    if (typeof certBuffer === 'string') {
+        if (isoBase64URL.isBase64URL(certBuffer)) {
+            b64cert = isoBase64URL.toBase64(certBuffer);
+        }
+        else if (isoBase64URL.isBase64(certBuffer)) {
+            b64cert = certBuffer;
+        }
+        else {
+            throw new Error('Certificate is not a valid base64 or base64url string');
+        }
+    }
+    else {
+        b64cert = isoBase64URL.fromBuffer(certBuffer, 'base64');
+    }
+    let PEMKey = '';
+    for (let i = 0; i < Math.ceil(b64cert.length / 64); i += 1) {
+        const start = 64 * i;
+        PEMKey += `${b64cert.substr(start, 64)}\n`;
+    }
+    PEMKey = `-----BEGIN CERTIFICATE-----\n${PEMKey}-----END CERTIFICATE-----\n`;
+    return PEMKey;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/convertPEMToBytes.js

@@ -0,0 +1,11 @@
+import { isoBase64URL } from './iso/index.js';
+/**
+ * Take a certificate in PEM format and convert it to bytes
+ */
+export function convertPEMToBytes(pem) {
+    const certBase64 = pem
+        .replace('-----BEGIN CERTIFICATE-----', '')
+        .replace('-----END CERTIFICATE-----', '')
+        .replace(/[\n ]/g, '');
+    return isoBase64URL.toBuffer(certBase64, 'base64');
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/convertX509PublicKeyToCOSE.js

@@ -0,0 +1,73 @@
+import { AsnParser } from '@peculiar/asn1-schema';
+import { Certificate } from '@peculiar/asn1-x509';
+import { ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1 } from '@peculiar/asn1-ecc';
+import { id_rsaEncryption, RSAPublicKey } from '@peculiar/asn1-rsa';
+import { COSECRV, COSEKEYS, COSEKTY, } from './cose.js';
+import { mapX509SignatureAlgToCOSEAlg } from './mapX509SignatureAlgToCOSEAlg.js';
+export function convertX509PublicKeyToCOSE(x509Certificate) {
+    let cosePublicKey = new Map();
+    /**
+     * Time to extract the public key from an X.509 certificate
+     */
+    const x509 = AsnParser.parse(x509Certificate, Certificate);
+    const { tbsCertificate } = x509;
+    const { subjectPublicKeyInfo, signature: _tbsSignature } = tbsCertificate;
+    const signatureAlgorithm = _tbsSignature.algorithm;
+    const publicKeyAlgorithmID = subjectPublicKeyInfo.algorithm.algorithm;
+    if (publicKeyAlgorithmID === id_ecPublicKey) {
+        /**
+         * EC2 Public Key
+         */
+        if (!subjectPublicKeyInfo.algorithm.parameters) {
+            throw new Error('Certificate public key was missing parameters (EC2)');
+        }
+        const ecParameters = AsnParser.parse(new Uint8Array(subjectPublicKeyInfo.algorithm.parameters), ECParameters);
+        let crv = -999;
+        const { namedCurve } = ecParameters;
+        if (namedCurve === id_secp256r1) {
+            crv = COSECRV.P256;
+        }
+        else if (namedCurve === id_secp384r1) {
+            crv = COSECRV.P384;
+        }
+        else {
+            throw new Error(`Certificate public key contained unexpected namedCurve ${namedCurve} (EC2)`);
+        }
+        const subjectPublicKey = new Uint8Array(subjectPublicKeyInfo.subjectPublicKey);
+        let x;
+        let y;
+        if (subjectPublicKey[0] === 0x04) {
+            // Public key is in "uncompressed form", so we can split the remaining bytes in half
+            let pointer = 1;
+            const halfLength = (subjectPublicKey.length - 1) / 2;
+            x = subjectPublicKey.slice(pointer, pointer += halfLength);
+            y = subjectPublicKey.slice(pointer);
+        }
+        else {
+            throw new Error('TODO: Figure out how to handle public keys in "compressed form"');
+        }
+        const coseEC2PubKey = new Map();
+        coseEC2PubKey.set(COSEKEYS.kty, COSEKTY.EC2);
+        coseEC2PubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        coseEC2PubKey.set(COSEKEYS.crv, crv);
+        coseEC2PubKey.set(COSEKEYS.x, x);
+        coseEC2PubKey.set(COSEKEYS.y, y);
+        cosePublicKey = coseEC2PubKey;
+    }
+    else if (publicKeyAlgorithmID === id_rsaEncryption) {
+        /**
+         * RSA public key
+         */
+        const rsaPublicKey = AsnParser.parse(subjectPublicKeyInfo.subjectPublicKey, RSAPublicKey);
+        const coseRSAPubKey = new Map();
+        coseRSAPubKey.set(COSEKEYS.kty, COSEKTY.RSA);
+        coseRSAPubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        coseRSAPubKey.set(COSEKEYS.n, new Uint8Array(rsaPublicKey.modulus));
+        coseRSAPubKey.set(COSEKEYS.e, new Uint8Array(rsaPublicKey.publicExponent));
+        cosePublicKey = coseRSAPubKey;
+    }
+    else {
+        throw new Error(`Certificate public key contained unexpected algorithm ID ${publicKeyAlgorithmID}`);
+    }
+    return cosePublicKey;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/cose.js

@@ -0,0 +1,90 @@
+/**
+ * A type guard for determining if a COSE public key is an OKP key pair
+ */
+export function isCOSEPublicKeyOKP(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.OKP;
+}
+/**
+ * A type guard for determining if a COSE public key is an EC2 key pair
+ */
+export function isCOSEPublicKeyEC2(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.EC2;
+}
+/**
+ * A type guard for determining if a COSE public key is an RSA key pair
+ */
+export function isCOSEPublicKeyRSA(cosePublicKey) {
+    const kty = cosePublicKey.get(COSEKEYS.kty);
+    return isCOSEKty(kty) && kty === COSEKTY.RSA;
+}
+/**
+ * COSE Keys
+ *
+ * https://www.iana.org/assignments/cose/cose.xhtml#key-common-parameters
+ * https://www.iana.org/assignments/cose/cose.xhtml#key-type-parameters
+ */
+export var COSEKEYS;
+(function (COSEKEYS) {
+    COSEKEYS[COSEKEYS["kty"] = 1] = "kty";
+    COSEKEYS[COSEKEYS["alg"] = 3] = "alg";
+    COSEKEYS[COSEKEYS["crv"] = -1] = "crv";
+    COSEKEYS[COSEKEYS["x"] = -2] = "x";
+    COSEKEYS[COSEKEYS["y"] = -3] = "y";
+    COSEKEYS[COSEKEYS["n"] = -1] = "n";
+    COSEKEYS[COSEKEYS["e"] = -2] = "e";
+})(COSEKEYS || (COSEKEYS = {}));
+/**
+ * COSE Key Types
+ *
+ * https://www.iana.org/assignments/cose/cose.xhtml#key-type
+ */
+export var COSEKTY;
+(function (COSEKTY) {
+    COSEKTY[COSEKTY["OKP"] = 1] = "OKP";
+    COSEKTY[COSEKTY["EC2"] = 2] = "EC2";
+    COSEKTY[COSEKTY["RSA"] = 3] = "RSA";
+})(COSEKTY || (COSEKTY = {}));
+export function isCOSEKty(kty) {
+    return Object.values(COSEKTY).indexOf(kty) >= 0;
+}
+/**
+ * COSE Curves
+ *
+ * https://www.iana.org/assignments/cose/cose.xhtml#elliptic-curves
+ */
+export var COSECRV;
+(function (COSECRV) {
+    COSECRV[COSECRV["P256"] = 1] = "P256";
+    COSECRV[COSECRV["P384"] = 2] = "P384";
+    COSECRV[COSECRV["P521"] = 3] = "P521";
+    COSECRV[COSECRV["ED25519"] = 6] = "ED25519";
+    COSECRV[COSECRV["SECP256K1"] = 8] = "SECP256K1";
+})(COSECRV || (COSECRV = {}));
+export function isCOSECrv(crv) {
+    return Object.values(COSECRV).indexOf(crv) >= 0;
+}
+/**
+ * COSE Algorithms
+ *
+ * https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ */
+export var COSEALG;
+(function (COSEALG) {
+    COSEALG[COSEALG["ES256"] = -7] = "ES256";
+    COSEALG[COSEALG["EdDSA"] = -8] = "EdDSA";
+    COSEALG[COSEALG["ES384"] = -35] = "ES384";
+    COSEALG[COSEALG["ES512"] = -36] = "ES512";
+    COSEALG[COSEALG["PS256"] = -37] = "PS256";
+    COSEALG[COSEALG["PS384"] = -38] = "PS384";
+    COSEALG[COSEALG["PS512"] = -39] = "PS512";
+    COSEALG[COSEALG["ES256K"] = -47] = "ES256K";
+    COSEALG[COSEALG["RS256"] = -257] = "RS256";
+    COSEALG[COSEALG["RS384"] = -258] = "RS384";
+    COSEALG[COSEALG["RS512"] = -259] = "RS512";
+    COSEALG[COSEALG["RS1"] = -65535] = "RS1";
+})(COSEALG || (COSEALG = {}));
+export function isCOSEAlg(alg) {
+    return Object.values(COSEALG).indexOf(alg) >= 0;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/decodeAttestationObject.js

@@ -0,0 +1,16 @@
+import { isoCBOR } from './iso/index.js';
+/**
+ * Convert an AttestationObject buffer to a proper object
+ *
+ * @param base64AttestationObject Attestation Object buffer
+ */
+export function decodeAttestationObject(attestationObject) {
+    return _decodeAttestationObjectInternals.stubThis(isoCBOR.decodeFirst(attestationObject));
+}
+/**
+ * Make it possible to stub the return value during testing
+ * @ignore Don't include this in docs output
+ */
+export const _decodeAttestationObjectInternals = {
+    stubThis: (value) => value,
+};

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/decodeAuthenticatorExtensions.js

@@ -0,0 +1,34 @@
+import { isoCBOR } from './iso/index.js';
+/**
+ * Convert authenticator extension data buffer to a proper object
+ *
+ * @param extensionData Authenticator Extension Data buffer
+ */
+export function decodeAuthenticatorExtensions(extensionData) {
+    let toCBOR;
+    try {
+        toCBOR = isoCBOR.decodeFirst(extensionData);
+    }
+    catch (err) {
+        const _err = err;
+        throw new Error(`Error decoding authenticator extensions: ${_err.message}`);
+    }
+    return convertMapToObjectDeep(toCBOR);
+}
+/**
+ * CBOR-encoded extensions can be deeply-nested Maps, which are too deep for a simple
+ * `Object.entries()`. This method will recursively make sure that all Maps are converted into
+ * basic objects.
+ */
+function convertMapToObjectDeep(input) {
+    const mapped = {};
+    for (const [key, value] of input) {
+        if (value instanceof Map) {
+            mapped[key] = convertMapToObjectDeep(value);
+        }
+        else {
+            mapped[key] = value;
+        }
+    }
+    return mapped;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/decodeClientDataJSON.js

@@ -0,0 +1,16 @@
+import { isoBase64URL } from './iso/index.js';
+/**
+ * Decode an authenticator's base64url-encoded clientDataJSON to JSON
+ */
+export function decodeClientDataJSON(data) {
+    const toString = isoBase64URL.toUTF8String(data);
+    const clientData = JSON.parse(toString);
+    return _decodeClientDataJSONInternals.stubThis(clientData);
+}
+/**
+ * Make it possible to stub the return value during testing
+ * @ignore Don't include this in docs output
+ */
+export const _decodeClientDataJSONInternals = {
+    stubThis: (value) => value,
+};

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/decodeCredentialPublicKey.js

@@ -0,0 +1,11 @@
+import { isoCBOR } from './iso/index.js';
+export function decodeCredentialPublicKey(publicKey) {
+    return _decodeCredentialPublicKeyInternals.stubThis(isoCBOR.decodeFirst(publicKey));
+}
+/**
+ * Make it possible to stub the return value during testing
+ * @ignore Don't include this in docs output
+ */
+export const _decodeCredentialPublicKeyInternals = {
+    stubThis: (value) => value,
+};

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/fetch.js

@@ -0,0 +1,14 @@
+/**
+ * A simple method for requesting data via standard `fetch`. Should work
+ * across multiple runtimes.
+ */
+export function fetch(url) {
+    return _fetchInternals.stubThis(url);
+}
+/**
+ * Make it possible to stub the return value during testing
+ * @ignore Don't include this in docs output
+ */
+export const _fetchInternals = {
+    stubThis: (url) => globalThis.fetch(url),
+};