@suaveplan/webauthn - W3C WebAuthn Level 3 client + parser + verifier — registration, authentication, every attestation format (packed, fido-u2f, tpm, android-key, android-safetynet, apple, none), PRF + largeBlob extensions, conditional UI, server-tier parser/verifier subpaths free of DOM types.

Summary

W3C WebAuthn Level 3 client + parser + verifier for Suaveplan. Browser-tier registration / authentication entry points sit on the package root; framework-agnostic parsing and verification surface lives under ./parser, ./verifier, and ./attestation/<fmt> subpaths so server-side relying-party verifiers can consume them without a DOM dependency.

Documentation tree

adapter — (no submodules) - dom-exception-mapper — Converts every `DOMException…
- adapter — (no submodules) - dom-exception-mapper — Converts every `DOMException…
- dom-exception-mapper — Converts every DOMException.name raised by navigator.credentials.create and navigator.credentials.get into a type…
android-key — (no submodules)
- android-key — (no submodules)
android-safetynet — (no submodules)
- android-safetynet — (no submodules)
apple — (no submodules)
- apple — (no submodules)
fido-u2f — (no submodules)
- fido-u2f — (no submodules)
none — (no submodules)
- none — (no submodules)
packed — (no submodules)
- packed — (no submodules)
tpm — (no submodules)
- tpm — (no submodules)
authenticate — (no submodules)
- authenticate — (no submodules)
errors — (no submodules)
- error-codes — (no submodules)
large-blob — (no submodules)
- large-blob — (no submodules)
prf — (no submodules)
- prf — (no submodules)
observability — (no submodules)
- metrics — (no submodules)
attestation-object — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by navigator.credentials.create(). The envelope is a t…
authenticator-data — Splits the binary authenticatorData byte string emitted by the authenticator into a typed ParsedAuthData structure…
client-data — Decodes the clientDataJSON byte string returned by navigator.credentials.create / get into a typed object and val…
cose-key — Decodes a COSE_Key byte string (RFC 9052 §7) into the typed CoseKey discriminated union supplied by `@suaveplan/cbo…
register — (no submodules)
- register — (no submodules)
schemas — (no submodules)
- schemas — (no submodules)
registry — Defines the pluggable contract every per-format attestation verifier implements (AttestationFormatVerifier), the shar…
sign-counter — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
verify-assertion — Implements verifyAssertion, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
verify-attestation — Implements verifyAttestation (W3C WebAuthn L3 §6.5.4) and defaultAttestationRegistry(). The dispatcher reads `attes…

- dom-exception-mapper — Converts every `DOMException…

adapter — (no submodules)- dom-exception-mapper — Converts every `DOMException…
dom-exception-mapper — Converts every DOMException.name raised by navigator.credentials.create and navigator.credentials.get into a type…
android-key — (no submodules)- android-key — (no submodules)- android-safetynet — (no submodules)- android-safetynet — (no submodules)- apple — (no submodules)- apple — (no submodules)- fido-u2f — (no submodules)- fido-u2f — (no submodules)- none — (no submodules)- none — (no submodules)- packed — (no submodules)- packed — (no submodules)- tpm — (no submodules)- tpm — (no submodules)- authenticate — (no submodules)- authenticate — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- large-blob — (no submodules)- large-blob — (no submodules)- prf — (no submodules)- prf — (no submodules)- observability — (no submodules)- metrics — (no submodules)- attestation-object — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by navigator.credentials.create(). The envelope is a t…
authenticator-data — Splits the binary authenticatorData byte string emitted by the authenticator into a typed ParsedAuthData structure…
client-data — Decodes the clientDataJSON byte string returned by navigator.credentials.create / get into a typed object and val…
cose-key — Decodes a COSE_Key byte string (RFC 9052 §7) into the typed CoseKey discriminated union supplied by `@suaveplan/cbo…
register — (no submodules)- register — (no submodules)- schemas — (no submodules)- schemas — (no submodules)- registry — Defines the pluggable contract every per-format attestation verifier implements (AttestationFormatVerifier), the shar…
sign-counter — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
verify-assertion — Implements verifyAssertion, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
verify-attestation — Implements verifyAttestation (W3C WebAuthn L3 §6.5.4) and defaultAttestationRegistry(). The dispatcher reads `attes…
dom-exception-mapper — Converts every `DOMException…
adapter — (no submodules)- dom-exception-mapper — Converts every `DOMException…
dom-exception-mapper — Converts every DOMException.name raised by navigator.credentials.create and navigator.credentials.get into a type…
android-key — (no submodules)- android-key — (no submodules)- android-safetynet — (no submodules)- android-safetynet — (no submodules)- apple — (no submodules)- apple — (no submodules)- fido-u2f — (no submodules)- fido-u2f — (no submodules)- none — (no submodules)- none — (no submodules)- packed — (no submodules)- packed — (no submodules)- tpm — (no submodules)- tpm — (no submodules)- authenticate — (no submodules)- authenticate — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- large-blob — (no submodules)- large-blob — (no submodules)- prf — (no submodules)- prf — (no submodules)- observability — (no submodules)- metrics — (no submodules)- attestation-object — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by navigator.credentials.create(). The envelope is a t…
authenticator-data — Splits the binary authenticatorData byte string emitted by the authenticator into a typed ParsedAuthData structure…
client-data — Decodes the clientDataJSON byte string returned by navigator.credentials.create / get into a typed object and val…
cose-key — Decodes a COSE_Key byte string (RFC 9052 §7) into the typed CoseKey discriminated union supplied by `@suaveplan/cbo…
register — (no submodules)- register — (no submodules)- schemas — (no submodules)- schemas — (no submodules)- registry — Defines the pluggable contract every per-format attestation verifier implements (AttestationFormatVerifier), the shar…
sign-counter — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
verify-assertion — Implements verifyAssertion, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
verify-attestation — Implements verifyAttestation (W3C WebAuthn L3 §6.5.4) and defaultAttestationRegistry(). The dispatcher reads `attes…
dom-exception-mapper — Converts every `DOMException…
adapter — (no submodules)- dom-exception-mapper — Converts every `DOMException…
dom-exception-mapper — Converts every DOMException.name raised by navigator.credentials.create and navigator.credentials.get into a type…
android-key — (no submodules)- android-key — (no submodules)- android-safetynet — (no submodules)- android-safetynet — (no submodules)- apple — (no submodules)- apple — (no submodules)- fido-u2f — (no submodules)- fido-u2f — (no submodules)- none — (no submodules)- none — (no submodules)- packed — (no submodules)- packed — (no submodules)- tpm — (no submodules)- tpm — (no submodules)- authenticate — (no submodules)- authenticate — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- large-blob — (no submodules)- large-blob — (no submodules)- prf — (no submodules)- prf — (no submodules)- observability — (no submodules)- metrics — (no submodules)- attestation-object — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by navigator.credentials.create(). The envelope is a t…
authenticator-data — Splits the binary authenticatorData byte string emitted by the authenticator into a typed ParsedAuthData structure…
client-data — Decodes the clientDataJSON byte string returned by navigator.credentials.create / get into a typed object and val…
cose-key — Decodes a COSE_Key byte string (RFC 9052 §7) into the typed CoseKey discriminated union supplied by `@suaveplan/cbo…
register — (no submodules)- register — (no submodules)- schemas — (no submodules)- schemas — (no submodules)- registry — Defines the pluggable contract every per-format attestation verifier implements (AttestationFormatVerifier), the shar…
sign-counter — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
verify-assertion — Implements verifyAssertion, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
verify-attestation — Implements verifyAttestation (W3C WebAuthn L3 §6.5.4) and defaultAttestationRegistry(). The dispatcher reads `attes…
adapter — (no submodules)- dom-exception-mapper — Converts every DOMException.name raised by navigator.credentials.create and navigator.credentials.get into a type…
android-key — (no submodules) - android-key — (no submodules)- android-safetynet — (no submodules) - android-safetynet — (no submodules)- apple — (no submodules) - apple — (no submodules)- fido-u2f — (no submodules) - fido-u2f — (no submodules)- none — (no submodules) - none — (no submodules)- packed — (no submodules) - packed — (no submodules)- tpm — (no submodules) - tpm — (no submodules)- authenticate — (no submodules) - authenticate — (no submodules)- errors — (no submodules) - error-codes — (no submodules)- large-blob — (no submodules) - large-blob — (no submodules)- prf — (no submodules) - prf — (no submodules)- observability — (no submodules) - metrics — (no submodules)- attestation-object — Decodes the CTAP 2.1 §6.5 attestation-object envelope returned by navigator.credentials.create(). The envelope is a t…
authenticator-data — Splits the binary authenticatorData byte string emitted by the authenticator into a typed ParsedAuthData structure…
client-data — Decodes the clientDataJSON byte string returned by navigator.credentials.create / get into a typed object and val…
cose-key — Decodes a COSE_Key byte string (RFC 9052 §7) into the typed CoseKey discriminated union supplied by `@suaveplan/cbo…
register — (no submodules) - register — (no submodules)- schemas — (no submodules) - schemas — (no submodules)- registry — Defines the pluggable contract every per-format attestation verifier implements (AttestationFormatVerifier), the shar…
sign-counter — Implements the W3C WebAuthn L3 §6.1.1 sign-counter regression check. Authenticators that maintain a monotonically-incre…
verify-assertion — Implements verifyAssertion, the cryptographic check at the heart of the WebAuthn authentication ceremony (W3C WebAuth…
verify-attestation — Implements verifyAttestation (W3C WebAuthn L3 §6.5.4) and defaultAttestationRegistry(). The dispatcher reads `attes…

Features

Registration (register(opts)) — builds PublicKeyCredentialCreationOptions, calls navigator.credentials.create via injectable adapter, parses the response into a typed RegisterResult.
Authentication (authenticate(opts)) — builds PublicKeyCredentialRequestOptions, calls navigator.credentials.get, parses the response into a typed AuthenticateResult. Supports conditional UI / autofill via mediation: "conditional".
Assertion verifier (verifyAssertion(input)) — ES256, ES384, ES512, EdDSA, RS256. Discriminated-union result so callers branch on ok: true | false.
Attestation verifiers for every IANA-registered format: packed, fido-u2f, tpm, android-key, android-safetynet, apple, none. Pluggable via registerAttestationFormat.
PRF extension (W3C L3 §10.1.4) — materialises a per-credential ~32-byte symmetric secret usable as a vault-key wrap key.
largeBlob extension (W3C L3 §10.1.3) — per-credential blob read / write.
DOMException → typed error mapping at every adapter boundary; raw DOMException never leaks to callers.
Constant-time challenge / rpIdHash / credential id comparisons via @suaveplan/crypto-utils.
OTel observability — histograms, counters, format-dispatch metric.

Modules

Module	Source	Docs
Adapter	`src/adapter/adapter.ts`	adapter.md
DOMException mapper	`src/adapter/dom-exception-mapper.ts`	dom-exception-mapper.md
Error codes	`src/errors/error-codes.ts`	error-codes.md
Observability / metrics	`src/observability/metrics.ts`	metrics.md
Schemas	`src/schemas/schemas.ts`	schemas.md
Client data	`src/parser/client-data.ts`	client-data.md
COSE_Key	`src/parser/cose-key.ts`	cose-key.md
Authenticator data	`src/parser/authenticator-data.ts`	authenticator-data.md
Attestation object	`src/parser/attestation-object.ts`	attestation-object.md
Registry	`src/verifier/registry.ts`	registry.md
Sign-counter	`src/verifier/sign-counter.ts`	sign-counter.md
Verify assertion	`src/verifier/verify-assertion.ts`	verify-assertion.md
Verify attestation	`src/verifier/verify-attestation.ts`	verify-attestation.md
`none`	`src/attestation/none/none.ts`	none.md
`packed`	`src/attestation/packed/packed.ts`	packed.md
`fido-u2f`	`src/attestation/fido-u2f/fido-u2f.ts`	fido-u2f.md
`tpm`	`src/attestation/tpm/tpm.ts`	tpm.md
`android-key`	`src/attestation/android-key/android-key.ts`	android-key.md
`android-safetynet`	`src/attestation/android-safetynet/android-safetynet.ts`	android-safetynet.md
`apple`	`src/attestation/apple/apple.ts`	apple.md
PRF extension	`src/extensions/prf/prf.ts`	prf.md
largeBlob extension	`src/extensions/large-blob/large-blob.ts`	large-blob.md
Register	`src/register/register.ts`	register.md
Authenticate	`src/authenticate/authenticate.ts`	authenticate.md

Standards

W3C WebAuthn Level 3 §5, §6, §7, §8, §9, §10
CTAP 2.1 §6.5 (Attestation Object)
RFC 9052 §7 (COSE_Key)
IANA WebAuthn registries

Subpath exports

. — browser-tier root barrel.
./adapter — WebAuthnAdapter interface + defaultWebAuthnAdapter.
./parser — universal parsers (parseAuthenticatorData, parseAttestationObject, parseClientDataJSON, parseCoseKey).
./verifier — universal verifiers (verifyAssertion, verifyAttestation, defaultAttestationRegistry, registerAttestationFormat).
./attestation/{packed,fido-u2f,tpm,android-key,android-safetynet,apple,none} — per-format verifiers.
./extensions/{prf,large-blob} — extension passthrough + result parsing.
./errors — error code registry + WebAuthnError.

28 KiB Raw Permalink Blame History