# @suaveplan/webauthn - W3C WebAuthn Level 3 client + parser + verifier — registration, authentication, every attestation format (packed, fido-u2f, tpm, android-key, android-safetynet, apple, none), PRF + largeBlob extensions, conditional UI, server-tier parser/verifier subpaths free of DOM types.

## Summary

W3C [WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) client + parser + verifier for Suaveplan. Browser-tier registration / authentication entry points sit on the package root; framework-agnostic parsing and verification surface lives under `./parser`, `./verifier`, and `./attestation/<fmt>` subpaths so server-side relying-party verifiers can consume them without a DOM dependency.

<!-- begin:auto-docs -->
## Documentation tree

- [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs --> - dom-exception-mapper — Converts every `DOMException…
  - [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs --> - dom-exception-mapper — Converts every `DOMException…
  - [dom-exception-mapper](./src/adapter/dom-exception-mapper.md) — Converts every `DOMException.name` raised by `navigator.credentials.create` and `navigator.credentials.get` into a type…
- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [attestation-object](./src/parser/attestation-object.md) — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by `navigator.credentials.create()`. The envelope is a t…
- [authenticator-data](./src/parser/authenticator-data.md) — Splits the binary `authenticatorData` byte string emitted by the authenticator into a typed `ParsedAuthData` structure…
- [client-data](./src/parser/client-data.md) — Decodes the `clientDataJSON` byte string returned by `navigator.credentials.create` / `get` into a typed object and val…
- [cose-key](./src/parser/cose-key.md) — Decodes a `COSE_Key` byte string (RFC 9052 §7) into the typed `CoseKey` discriminated union supplied by `@suaveplan/cbo…
- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
- [registry](./src/verifier/registry.md) — Defines the pluggable contract every per-format attestation verifier implements (`AttestationFormatVerifier`), the shar…
- [sign-counter](./src/verifier/sign-counter.md) — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
- [verify-assertion](./src/verifier/verify-assertion.md) — Implements `verifyAssertion`, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
- [verify-attestation](./src/verifier/verify-attestation.md) — Implements `verifyAttestation` (W3C WebAuthn L3 §6.5.4) and `defaultAttestationRegistry()`. The dispatcher reads `attes…
<!-- end:auto-docs --> - dom-exception-mapper — Converts every `DOMException…
  - [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_- dom-exception-mapper — Converts every `DOMException…
  - [dom-exception-mapper](./src/adapter/dom-exception-mapper.md) — Converts every `DOMException.name` raised by `navigator.credentials.create` and `navigator.credentials.get` into a type…
- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [attestation-object](./src/parser/attestation-object.md) — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by `navigator.credentials.create()`. The envelope is a t…
- [authenticator-data](./src/parser/authenticator-data.md) — Splits the binary `authenticatorData` byte string emitted by the authenticator into a typed `ParsedAuthData` structure…
- [client-data](./src/parser/client-data.md) — Decodes the `clientDataJSON` byte string returned by `navigator.credentials.create` / `get` into a typed object and val…
- [cose-key](./src/parser/cose-key.md) — Decodes a `COSE_Key` byte string (RFC 9052 §7) into the typed `CoseKey` discriminated union supplied by `@suaveplan/cbo…
- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [registry](./src/verifier/registry.md) — Defines the pluggable contract every per-format attestation verifier implements (`AttestationFormatVerifier`), the shar…
- [sign-counter](./src/verifier/sign-counter.md) — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
- [verify-assertion](./src/verifier/verify-assertion.md) — Implements `verifyAssertion`, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
- [verify-attestation](./src/verifier/verify-attestation.md) — Implements `verifyAttestation` (W3C WebAuthn L3 §6.5.4) and `defaultAttestationRegistry()`. The dispatcher reads `attes…

- dom-exception-mapper — Converts every `DOMException…

- [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_- dom-exception-mapper — Converts every `DOMException…
- [dom-exception-mapper](./src/adapter/dom-exception-mapper.md) — Converts every `DOMException.name` raised by `navigator.credentials.create` and `navigator.credentials.get` into a type…
- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [attestation-object](./src/parser/attestation-object.md) — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by `navigator.credentials.create()`. The envelope is a t…
- [authenticator-data](./src/parser/authenticator-data.md) — Splits the binary `authenticatorData` byte string emitted by the authenticator into a typed `ParsedAuthData` structure…
- [client-data](./src/parser/client-data.md) — Decodes the `clientDataJSON` byte string returned by `navigator.credentials.create` / `get` into a typed object and val…
- [cose-key](./src/parser/cose-key.md) — Decodes a `COSE_Key` byte string (RFC 9052 §7) into the typed `CoseKey` discriminated union supplied by `@suaveplan/cbo…
- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [registry](./src/verifier/registry.md) — Defines the pluggable contract every per-format attestation verifier implements (`AttestationFormatVerifier`), the shar…
- [sign-counter](./src/verifier/sign-counter.md) — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
- [verify-assertion](./src/verifier/verify-assertion.md) — Implements `verifyAssertion`, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
- [verify-attestation](./src/verifier/verify-attestation.md) — Implements `verifyAttestation` (W3C WebAuthn L3 §6.5.4) and `defaultAttestationRegistry()`. The dispatcher reads `attes…

- dom-exception-mapper — Converts every `DOMException…

- [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_- dom-exception-mapper — Converts every `DOMException…
- [dom-exception-mapper](./src/adapter/dom-exception-mapper.md) — Converts every `DOMException.name` raised by `navigator.credentials.create` and `navigator.credentials.get` into a type…
- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [attestation-object](./src/parser/attestation-object.md) — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by `navigator.credentials.create()`. The envelope is a t…
- [authenticator-data](./src/parser/authenticator-data.md) — Splits the binary `authenticatorData` byte string emitted by the authenticator into a typed `ParsedAuthData` structure…
- [client-data](./src/parser/client-data.md) — Decodes the `clientDataJSON` byte string returned by `navigator.credentials.create` / `get` into a typed object and val…
- [cose-key](./src/parser/cose-key.md) — Decodes a `COSE_Key` byte string (RFC 9052 §7) into the typed `CoseKey` discriminated union supplied by `@suaveplan/cbo…
- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [registry](./src/verifier/registry.md) — Defines the pluggable contract every per-format attestation verifier implements (`AttestationFormatVerifier`), the shar…
- [sign-counter](./src/verifier/sign-counter.md) — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
- [verify-assertion](./src/verifier/verify-assertion.md) — Implements `verifyAssertion`, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
- [verify-attestation](./src/verifier/verify-attestation.md) — Implements `verifyAttestation` (W3C WebAuthn L3 §6.5.4) and `defaultAttestationRegistry()`. The dispatcher reads `attes…
- [adapter](./src/adapter/adapter.md) — <!-- begin:auto-docs --> _(no submodules)_- [dom-exception-mapper](./src/adapter/dom-exception-mapper.md) — Converts every `DOMException.name` raised by `navigator.credentials.create` and `navigator.credentials.get` into a type…
- [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_  - [android-key](./src/attestation/android-key/android-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_  - [android-safetynet](./src/attestation/android-safetynet/android-safetynet.md) — <!-- begin:auto-docs --> _(no submodules)_- [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_  - [apple](./src/attestation/apple/apple.md) — <!-- begin:auto-docs --> _(no submodules)_- [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_  - [fido-u2f](./src/attestation/fido-u2f/fido-u2f.md) — <!-- begin:auto-docs --> _(no submodules)_- [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_  - [none](./src/attestation/none/none.md) — <!-- begin:auto-docs --> _(no submodules)_- [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_  - [packed](./src/attestation/packed/packed.md) — <!-- begin:auto-docs --> _(no submodules)_- [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_  - [tpm](./src/attestation/tpm/tpm.md) — <!-- begin:auto-docs --> _(no submodules)_- [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [authenticate](./src/authenticate/authenticate.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_  - [large-blob](./src/extensions/large-blob/large-blob.md) — <!-- begin:auto-docs --> _(no submodules)_- [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_  - [prf](./src/extensions/prf/prf.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [attestation-object](./src/parser/attestation-object.md) — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by `navigator.credentials.create()`. The envelope is a t…
- [authenticator-data](./src/parser/authenticator-data.md) — Splits the binary `authenticatorData` byte string emitted by the authenticator into a typed `ParsedAuthData` structure…
- [client-data](./src/parser/client-data.md) — Decodes the `clientDataJSON` byte string returned by `navigator.credentials.create` / `get` into a typed object and val…
- [cose-key](./src/parser/cose-key.md) — Decodes a `COSE_Key` byte string (RFC 9052 §7) into the typed `CoseKey` discriminated union supplied by `@suaveplan/cbo…
- [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_  - [register](./src/register/register.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [registry](./src/verifier/registry.md) — Defines the pluggable contract every per-format attestation verifier implements (`AttestationFormatVerifier`), the shar…
- [sign-counter](./src/verifier/sign-counter.md) — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
- [verify-assertion](./src/verifier/verify-assertion.md) — Implements `verifyAssertion`, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
- [verify-attestation](./src/verifier/verify-attestation.md) — Implements `verifyAttestation` (W3C WebAuthn L3 §6.5.4) and `defaultAttestationRegistry()`. The dispatcher reads `attes…

## Features

- **Registration** (`register(opts)`) — builds `PublicKeyCredentialCreationOptions`, calls `navigator.credentials.create` via injectable adapter, parses the response into a typed `RegisterResult`.
- **Authentication** (`authenticate(opts)`) — builds `PublicKeyCredentialRequestOptions`, calls `navigator.credentials.get`, parses the response into a typed `AuthenticateResult`. Supports conditional UI / autofill via `mediation: "conditional"`.
- **Assertion verifier** (`verifyAssertion(input)`) — ES256, ES384, ES512, EdDSA, RS256. Discriminated-union result so callers branch on `ok: true | false`.
- **Attestation verifiers** for every IANA-registered format: `packed`, `fido-u2f`, `tpm`, `android-key`, `android-safetynet`, `apple`, `none`. Pluggable via `registerAttestationFormat`.
- **PRF extension** ([W3C L3 §10.1.4](https://www.w3.org/TR/webauthn-3/#prf-extension)) — materialises a per-credential ~32-byte symmetric secret usable as a vault-key wrap key.
- **largeBlob extension** ([W3C L3 §10.1.3](https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension)) — per-credential blob read / write.
- **DOMException → typed error mapping** at every adapter boundary; raw `DOMException` never leaks to callers.
- **Constant-time** challenge / `rpIdHash` / credential id comparisons via `@suaveplan/crypto-utils`.
- **OTel observability** — histograms, counters, format-dispatch metric.

## Modules

| Module | Source | Docs |
|---|---|---|
| Adapter | `src/adapter/adapter.ts` | [adapter.md](src/adapter/adapter.md) |
| DOMException mapper | `src/adapter/dom-exception-mapper.ts` | [dom-exception-mapper.md](src/adapter/dom-exception-mapper.md) |
| Error codes | `src/errors/error-codes.ts` | [error-codes.md](src/errors/error-codes.md) |
| Observability / metrics | `src/observability/metrics.ts` | [metrics.md](src/observability/metrics.md) |
| Schemas | `src/schemas/schemas.ts` | [schemas.md](src/schemas/schemas.md) |
| Client data | `src/parser/client-data.ts` | [client-data.md](src/parser/client-data.md) |
| COSE_Key | `src/parser/cose-key.ts` | [cose-key.md](src/parser/cose-key.md) |
| Authenticator data | `src/parser/authenticator-data.ts` | [authenticator-data.md](src/parser/authenticator-data.md) |
| Attestation object | `src/parser/attestation-object.ts` | [attestation-object.md](src/parser/attestation-object.md) |
| Registry | `src/verifier/registry.ts` | [registry.md](src/verifier/registry.md) |
| Sign-counter | `src/verifier/sign-counter.ts` | [sign-counter.md](src/verifier/sign-counter.md) |
| Verify assertion | `src/verifier/verify-assertion.ts` | [verify-assertion.md](src/verifier/verify-assertion.md) |
| Verify attestation | `src/verifier/verify-attestation.ts` | [verify-attestation.md](src/verifier/verify-attestation.md) |
| `none` | `src/attestation/none/none.ts` | [none.md](src/attestation/none/none.md) |
| `packed` | `src/attestation/packed/packed.ts` | [packed.md](src/attestation/packed/packed.md) |
| `fido-u2f` | `src/attestation/fido-u2f/fido-u2f.ts` | [fido-u2f.md](src/attestation/fido-u2f/fido-u2f.md) |
| `tpm` | `src/attestation/tpm/tpm.ts` | [tpm.md](src/attestation/tpm/tpm.md) |
| `android-key` | `src/attestation/android-key/android-key.ts` | [android-key.md](src/attestation/android-key/android-key.md) |
| `android-safetynet` | `src/attestation/android-safetynet/android-safetynet.ts` | [android-safetynet.md](src/attestation/android-safetynet/android-safetynet.md) |
| `apple` | `src/attestation/apple/apple.ts` | [apple.md](src/attestation/apple/apple.md) |
| PRF extension | `src/extensions/prf/prf.ts` | [prf.md](src/extensions/prf/prf.md) |
| largeBlob extension | `src/extensions/large-blob/large-blob.ts` | [large-blob.md](src/extensions/large-blob/large-blob.md) |
| Register | `src/register/register.ts` | [register.md](src/register/register.md) |
| Authenticate | `src/authenticate/authenticate.ts` | [authenticate.md](src/authenticate/authenticate.md) |

## Standards

- [W3C WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) §5, §6, §7, §8, §9, §10
- [CTAP 2.1](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html) §6.5 (Attestation Object)
- [RFC 9052](https://datatracker.ietf.org/doc/html/rfc9052) §7 (COSE_Key)
- [IANA WebAuthn registries](https://www.iana.org/assignments/webauthn)

## Subpath exports

- `.` — browser-tier root barrel.
- `./adapter` — `WebAuthnAdapter` interface + `defaultWebAuthnAdapter`.
- `./parser` — universal parsers (`parseAuthenticatorData`, `parseAttestationObject`, `parseClientDataJSON`, `parseCoseKey`).
- `./verifier` — universal verifiers (`verifyAssertion`, `verifyAttestation`, `defaultAttestationRegistry`, `registerAttestationFormat`).
- `./attestation/{packed,fido-u2f,tpm,android-key,android-safetynet,apple,none}` — per-format verifiers.
- `./extensions/{prf,large-blob}` — extension passthrough + result parsing.
- `./errors` — error code registry + `WebAuthnError`.