Cbor

A minimal CBOR (RFC 8949) decoder — only the shapes WebAuthn attestation needs. WebAuthn's `attestationObject` and its embedded COSE public key are CBOR, so reading a registration means reading CBOR. Rather than take a heavy dependency for a handful of major types, this decodes exactly what appears there: unsigned and negative integers, byte and text strings, arrays and maps (major types 0–5). Indefinite-length items, tags, floats, and simple values are NOT supported — an authenticator does not emit them here, and refusing them keeps the surface small and honest. It is deliberately strict: anything it does not understand, or any trailing garbage, throws. A parser that guesses past a malformed attestation is a security bug, not a convenience.

public static function decode(string $bytes): ?mixed

Decode one CBOR item from the head of $bytes, requiring it to consume the whole string.

Parameters

Returns

the decoded value (int, string, list, or array-map)

public static function decodeItem(string $bytes, int $offset): ?mixed

Decode one item starting at $offset, advancing $offset past it.

Parameters