feat: release OTP and Passkey Tools 0.1.0

tests/webauthn/cbor.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { decodeCompleteCbor } from "../../src/webauthn/cbor";
+
+describe("bounded CBOR decoder", () => {
+  it("decodes deterministic maps and byte strings", () => {
+    const value = decodeCompleteCbor(
+      Uint8Array.from([
+        0xa2, 0x01, 0x42, 0xaa, 0xbb, 0x63, 0x66, 0x6d, 0x74, 0x64, 0x6e, 0x6f,
+        0x6e, 0x65,
+      ]),
+    );
+    expect(value).toBeInstanceOf(Map);
+    expect((value as Map<unknown, unknown>).get("fmt")).toBe("none");
+  });
+
+  it("rejects indefinite, duplicate and trailing encodings", () => {
+    expect(() => decodeCompleteCbor(Uint8Array.from([0x9f, 0xff]))).toThrow(
+      /Indefinite/iu,
+    );
+    expect(() =>
+      decodeCompleteCbor(Uint8Array.from([0xa2, 0x01, 0x01, 0x01, 0x02])),
+    ).toThrow(/duplicate/iu);
+    expect(() =>
+      decodeCompleteCbor(
+        Uint8Array.from([0xa2, 0x41, 0xaa, 0x01, 0x41, 0xaa, 0x02]),
+      ),
+    ).toThrow(/duplicate/iu);
+    expect(() => decodeCompleteCbor(Uint8Array.from([0x01, 0x02]))).toThrow(
+      /trailing/iu,
+    );
+  });
+
+  it("enforces depth and item limits", () => {
+    expect(() =>
+      decodeCompleteCbor(
+        Uint8Array.from([...Array.from({ length: 34 }, () => 0x81), 0x00]),
+      ),
+    ).toThrow(/deep/iu);
+  });
+});