agentplugged 0.0.0-stage → 1.0.0

package/dist/esm.js

@@ -0,0 +1,920 @@
+import { a as __toCommonJS, t as __commonJSMin } from "./rolldown-runtime.js";
+import { C as require_cjs$1, E as PQCNotSupportedError, M as isBase64URL, N as toBuffer, S as require_cjs$2, T as tslib_es6_exports, b as concat, c as parseAuthenticatorData, f as decodeCredentialPublicKey, i as verifySignature, j as isPQCCOSEAlg, k as COSEKEYS, m as decodeClientDataJSON, n as SettingsService, o as toHash, t as verifyMDSBlob, u as fetch, v as convertAAGUIDToString, w as init_tslib_es6, x as fromASCIIString, y as areEqual } from "./helpers.js";
+//#region ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/parseBackupFlags.js
+/**
+* Make sense of Bits 3 and 4 in authenticator indicating:
+*
+* - Whether the credential can be used on multiple devices
+* - Whether the credential is backed up or not
+*
+* Invalid configurations will raise an `Error`
+*/
+function parseBackupFlags({ be, bs }) {
+	const credentialBackedUp = bs;
+	let credentialDeviceType = "singleDevice";
+	if (be) credentialDeviceType = "multiDevice";
+	if (credentialDeviceType === "singleDevice" && credentialBackedUp) throw new InvalidBackupFlags("Single-device credential indicated that it was backed up, which should be impossible.");
+	return {
+		credentialDeviceType,
+		credentialBackedUp
+	};
+}
+var InvalidBackupFlags = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidBackupFlags";
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/matchExpectedRPID.js
+/**
+* Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
+* that matched the hash in the response.
+*
+* Raises an `UnexpectedRPIDHash` error if no match is found
+*/
+async function matchExpectedRPID(rpIDHash, expectedRPIDs) {
+	try {
+		return await Promise.any(expectedRPIDs.map((expected) => {
+			return new Promise((resolve, reject) => {
+				toHash(fromASCIIString(expected)).then((expectedRPIDHash) => {
+					if (areEqual(rpIDHash, expectedRPIDHash)) resolve(expected);
+					else reject();
+				});
+			});
+		}));
+	} catch (err) {
+		if (err.name === "AggregateError") throw new UnexpectedRPIDHash();
+		throw err;
+	}
+}
+var UnexpectedRPIDHash = class extends Error {
+	constructor() {
+		super("Unexpected RP ID hash");
+		this.name = "UnexpectedRPIDHash";
+	}
+};
+require_cjs$1();
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/logging.js
+/**
+* A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+* of the `SimpleWebAuthnLogger` interface is specified.
+*/
+const DefaultNoopLogger = {
+	debug() {},
+	info() {},
+	warn() {},
+	error() {}
+};
+/**
+* Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+* defined on `logger` will be a no-op.
+*/
+function buildLoggerAllMethods(logger) {
+	const toReturn = { ...DefaultNoopLogger };
+	if (logger.debug) toReturn.debug = logger.debug;
+	if (logger.info) toReturn.info = logger.info;
+	if (logger.warn) toReturn.warn = logger.warn;
+	if (logger.error) toReturn.error = logger.error;
+	return toReturn;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/metadataService.js
+/**
+* An instance of `CachedMDS` that will not trigger attempts to refresh the associated entry's blob
+*/
+const NonRefreshingMDS = {
+	url: "",
+	no: 0,
+	nextUpdate: /* @__PURE__ */ new Date(0)
+};
+const defaultURLMDS = "https://mds.fidoalliance.org/";
+var SERVICE_STATE;
+(function(SERVICE_STATE) {
+	SERVICE_STATE[SERVICE_STATE["DISABLED"] = 0] = "DISABLED";
+	SERVICE_STATE[SERVICE_STATE["REFRESHING"] = 1] = "REFRESHING";
+	SERVICE_STATE[SERVICE_STATE["READY"] = 2] = "READY";
+})(SERVICE_STATE || (SERVICE_STATE = {}));
+/**
+* An implementation of `MetadataService` that can download and parse BLOBs, and support on-demand
+* requesting and caching of individual metadata statements.
+*
+* https://fidoalliance.org/metadata/
+*/
+var BaseMetadataService = class {
+	constructor() {
+		Object.defineProperty(this, "mdsCache", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: {}
+		});
+		Object.defineProperty(this, "statementCache", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: {}
+		});
+		Object.defineProperty(this, "state", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: SERVICE_STATE.DISABLED
+		});
+		Object.defineProperty(this, "verificationMode", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: "strict"
+		});
+		Object.defineProperty(this, "logger", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: DefaultNoopLogger
+		});
+	}
+	async initialize(opts = {}) {
+		this.statementCache = {};
+		const { mdsServers = [defaultURLMDS], statements, verificationMode, logger = DefaultNoopLogger } = opts;
+		this.logger = buildLoggerAllMethods(logger);
+		this.setState(SERVICE_STATE.REFRESHING);
+		/**
+		* If metadata statements are provided, load them into the cache first. These statements will
+		* not be refreshed when a stale one is detected.
+		*/
+		if (statements?.length) {
+			let statementsAdded = 0;
+			statements.forEach((statement) => {
+				if (statement.aaguid) {
+					this.statementCache[statement.aaguid] = {
+						entry: {
+							metadataStatement: statement,
+							statusReports: [],
+							timeOfLastStatusChange: "1970-01-01"
+						},
+						url: NonRefreshingMDS.url
+					};
+					statementsAdded += 1;
+				}
+			});
+			this.logger.info(`Cached ${statementsAdded} local statements`);
+		}
+		/**
+		* If MDS servers are provided, then download blobs from them, verify them, and then add their
+		* entries to the cache. Blobs loaded in this way will be refreshed when a stale entry within is
+		* detected.
+		*/
+		if (mdsServers?.length) {
+			const currentCacheCount = Object.keys(this.statementCache).length;
+			let numServers = mdsServers.length;
+			for (const url of mdsServers) try {
+				const cachedMDS = {
+					url,
+					no: 0,
+					nextUpdate: /* @__PURE__ */ new Date(0)
+				};
+				const blob = await this.downloadBlob(cachedMDS);
+				await this.verifyBlob(blob, cachedMDS);
+			} catch (err) {
+				this.logger.error(`Could not download BLOB from ${url}:`, err);
+				numServers -= 1;
+			}
+			const cacheDiff = Object.keys(this.statementCache).length - currentCacheCount;
+			this.logger.info(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
+		}
+		if (verificationMode) this.verificationMode = verificationMode;
+		this.setState(SERVICE_STATE.READY);
+	}
+	async getStatement(aaguid) {
+		if (this.state === SERVICE_STATE.DISABLED) return;
+		if (!aaguid) return;
+		if (aaguid instanceof Uint8Array) aaguid = convertAAGUIDToString(aaguid);
+		await this.pauseUntilReady();
+		const cachedStatement = this.statementCache[aaguid];
+		if (!cachedStatement) {
+			if (this.verificationMode === "strict") throw new Error(`No metadata statement found for aaguid "${aaguid}"`);
+			return;
+		}
+		if (cachedStatement.url) {
+			const mds = this.mdsCache[cachedStatement.url];
+			if (/* @__PURE__ */ new Date() > mds.nextUpdate) try {
+				this.setState(SERVICE_STATE.REFRESHING);
+				const blob = await this.downloadBlob(mds);
+				await this.verifyBlob(blob, mds);
+			} finally {
+				this.setState(SERVICE_STATE.READY);
+			}
+		}
+		const { entry } = cachedStatement;
+		for (const report of entry.statusReports) {
+			const { status } = report;
+			if (status === "USER_VERIFICATION_BYPASS" || status === "ATTESTATION_KEY_COMPROMISE" || status === "USER_KEY_REMOTE_COMPROMISE" || status === "USER_KEY_PHYSICAL_COMPROMISE") throw new Error(`Detected compromised aaguid "${aaguid}"`);
+		}
+		return entry.metadataStatement;
+	}
+	/**
+	* Download and process the latest BLOB from MDS
+	*/
+	async downloadBlob(cachedMDS) {
+		const { url } = cachedMDS;
+		return await (await fetch(url)).text();
+	}
+	/**
+	* Verify and process the MDS metadata blob
+	*/
+	async verifyBlob(blob, cachedMDS) {
+		const { url, no } = cachedMDS;
+		const { payload, parsedNextUpdate } = await verifyMDSBlob(blob);
+		if (payload.no <= no) throw new Error(`Latest BLOB no. ${payload.no} is not greater than previous no. ${no}`);
+		for (const entry of payload.entries) if (entry.aaguid) this.statementCache[entry.aaguid] = {
+			entry,
+			url
+		};
+		if (url) this.mdsCache[url] = {
+			...cachedMDS,
+			no: payload.no,
+			nextUpdate: parsedNextUpdate
+		};
+		else if (parsedNextUpdate < /* @__PURE__ */ new Date()) this.logger.warn(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
+	}
+	/**
+	* A helper method to pause execution until the service is ready
+	*/
+	pauseUntilReady() {
+		if (this.state === SERVICE_STATE.READY) return new Promise((resolve) => {
+			resolve();
+		});
+		return new Promise((resolve, reject) => {
+			const totalTimeoutMS = 7e4;
+			const intervalMS = 100;
+			let iterations = totalTimeoutMS / intervalMS;
+			const intervalID = globalThis.setInterval(() => {
+				if (iterations < 1) {
+					clearInterval(intervalID);
+					reject(`State did not become ready in ${totalTimeoutMS / 1e3} seconds`);
+				} else if (this.state === SERVICE_STATE.READY) {
+					clearInterval(intervalID);
+					resolve();
+				}
+				iterations -= 1;
+			}, intervalMS);
+		});
+	}
+	/**
+	* Report service status on change
+	*/
+	setState(newState) {
+		this.state = newState;
+		if (newState === SERVICE_STATE.DISABLED) this.logger.debug("MetadataService is DISABLED");
+		else if (newState === SERVICE_STATE.REFRESHING) this.logger.debug("MetadataService is REFRESHING");
+		else if (newState === SERVICE_STATE.READY) this.logger.debug("MetadataService is READY");
+	}
+};
+new BaseMetadataService();
+require_cjs$2();
+//#endregion
+//#region ../../node_modules/.pnpm/@peculiar+asn1-android@2.11.0/node_modules/@peculiar/asn1-android/build/cjs/key_description.js
+var require_key_description = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var IntegerSet_1;
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.KeyMintKeyDescription = exports.KeyDescription = exports.Version = exports.SecurityLevel = exports.AuthorizationList = exports.IntegerSet = exports.RootOfTrust = exports.VerifiedBootState = exports.id_ce_keyDescription = void 0;
+	const tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+	const asn1_schema_1 = require_cjs$1();
+	exports.id_ce_keyDescription = "1.3.6.1.4.1.11129.2.1.17";
+	var VerifiedBootState;
+	(function(VerifiedBootState) {
+		VerifiedBootState[VerifiedBootState["verified"] = 0] = "verified";
+		VerifiedBootState[VerifiedBootState["selfSigned"] = 1] = "selfSigned";
+		VerifiedBootState[VerifiedBootState["unverified"] = 2] = "unverified";
+		VerifiedBootState[VerifiedBootState["failed"] = 3] = "failed";
+	})(VerifiedBootState || (exports.VerifiedBootState = VerifiedBootState = {}));
+	var RootOfTrust = class {
+		verifiedBootKey = new asn1_schema_1.OctetString();
+		deviceLocked = false;
+		verifiedBootState = VerifiedBootState.verified;
+		verifiedBootHash;
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.RootOfTrust = RootOfTrust;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], RootOfTrust.prototype, "verifiedBootKey", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Boolean })], RootOfTrust.prototype, "deviceLocked", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], RootOfTrust.prototype, "verifiedBootState", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], RootOfTrust.prototype, "verifiedBootHash", void 0);
+	let IntegerSet = IntegerSet_1 = class IntegerSet extends asn1_schema_1.AsnArray {
+		constructor(items) {
+			super(items);
+			Object.setPrototypeOf(this, IntegerSet_1.prototype);
+		}
+	};
+	exports.IntegerSet = IntegerSet;
+	exports.IntegerSet = IntegerSet = IntegerSet_1 = tslib_1.__decorate([(0, asn1_schema_1.AsnType)({
+		type: asn1_schema_1.AsnTypeTypes.Set,
+		itemType: asn1_schema_1.AsnPropTypes.Integer
+	})], IntegerSet);
+	var AuthorizationList = class {
+		purpose;
+		algorithm;
+		keySize;
+		digest;
+		padding;
+		ecCurve;
+		rsaPublicExponent;
+		mgfDigest;
+		rollbackResistance;
+		earlyBootOnly;
+		activeDateTime;
+		originationExpireDateTime;
+		usageExpireDateTime;
+		usageCountLimit;
+		noAuthRequired;
+		userAuthType;
+		authTimeout;
+		allowWhileOnBody;
+		trustedUserPresenceRequired;
+		trustedConfirmationRequired;
+		unlockedDeviceRequired;
+		allApplications;
+		applicationId;
+		creationDateTime;
+		origin;
+		rollbackResistant;
+		rootOfTrust;
+		osVersion;
+		osPatchLevel;
+		attestationApplicationId;
+		attestationIdBrand;
+		attestationIdDevice;
+		attestationIdProduct;
+		attestationIdSerial;
+		attestationIdImei;
+		attestationIdMeid;
+		attestationIdManufacturer;
+		attestationIdModel;
+		vendorPatchLevel;
+		bootPatchLevel;
+		deviceUniqueAttestation;
+		attestationIdSecondImei;
+		moduleHash;
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.AuthorizationList = AuthorizationList;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 1,
+		type: IntegerSet,
+		optional: true
+	})], AuthorizationList.prototype, "purpose", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 2,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "algorithm", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 3,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "keySize", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 5,
+		type: IntegerSet,
+		optional: true
+	})], AuthorizationList.prototype, "digest", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 6,
+		type: IntegerSet,
+		optional: true
+	})], AuthorizationList.prototype, "padding", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 10,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "ecCurve", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 200,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "rsaPublicExponent", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 203,
+		type: IntegerSet,
+		optional: true
+	})], AuthorizationList.prototype, "mgfDigest", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 303,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "rollbackResistance", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 305,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "earlyBootOnly", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 400,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "activeDateTime", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 401,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "originationExpireDateTime", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 402,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "usageExpireDateTime", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 405,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "usageCountLimit", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 503,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "noAuthRequired", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 504,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "userAuthType", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 505,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "authTimeout", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 506,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "allowWhileOnBody", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 507,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "trustedUserPresenceRequired", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 508,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "trustedConfirmationRequired", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 509,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "unlockedDeviceRequired", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 600,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "allApplications", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 601,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "applicationId", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 701,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "creationDateTime", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 702,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "origin", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 703,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "rollbackResistant", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 704,
+		type: RootOfTrust,
+		optional: true
+	})], AuthorizationList.prototype, "rootOfTrust", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 705,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "osVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 706,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "osPatchLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 709,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationApplicationId", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 710,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdBrand", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 711,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdDevice", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 712,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdProduct", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 713,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdSerial", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 714,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdImei", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 715,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdMeid", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 716,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdManufacturer", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 717,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdModel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 718,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "vendorPatchLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 719,
+		type: asn1_schema_1.AsnPropTypes.Integer,
+		optional: true
+	})], AuthorizationList.prototype, "bootPatchLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 720,
+		type: asn1_schema_1.AsnPropTypes.Null,
+		optional: true
+	})], AuthorizationList.prototype, "deviceUniqueAttestation", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 723,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "attestationIdSecondImei", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		context: 724,
+		type: asn1_schema_1.OctetString,
+		optional: true
+	})], AuthorizationList.prototype, "moduleHash", void 0);
+	var SecurityLevel;
+	(function(SecurityLevel) {
+		SecurityLevel[SecurityLevel["software"] = 0] = "software";
+		SecurityLevel[SecurityLevel["trustedEnvironment"] = 1] = "trustedEnvironment";
+		SecurityLevel[SecurityLevel["strongBox"] = 2] = "strongBox";
+	})(SecurityLevel || (exports.SecurityLevel = SecurityLevel = {}));
+	var Version;
+	(function(Version) {
+		Version[Version["KM2"] = 1] = "KM2";
+		Version[Version["KM3"] = 2] = "KM3";
+		Version[Version["KM4"] = 3] = "KM4";
+		Version[Version["KM4_1"] = 4] = "KM4_1";
+		Version[Version["keyMint1"] = 100] = "keyMint1";
+		Version[Version["keyMint2"] = 200] = "keyMint2";
+		Version[Version["keyMint3"] = 300] = "keyMint3";
+		Version[Version["keyMint4"] = 400] = "keyMint4";
+	})(Version || (exports.Version = Version = {}));
+	var KeyDescription = class {
+		attestationVersion = Version.KM4;
+		attestationSecurityLevel = SecurityLevel.software;
+		keymasterVersion = 0;
+		keymasterSecurityLevel = SecurityLevel.software;
+		attestationChallenge = new asn1_schema_1.OctetString();
+		uniqueId = new asn1_schema_1.OctetString();
+		softwareEnforced = new AuthorizationList();
+		teeEnforced = new AuthorizationList();
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.KeyDescription = KeyDescription;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], KeyDescription.prototype, "attestationVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], KeyDescription.prototype, "attestationSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], KeyDescription.prototype, "keymasterVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], KeyDescription.prototype, "keymasterSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], KeyDescription.prototype, "attestationChallenge", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], KeyDescription.prototype, "uniqueId", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: AuthorizationList })], KeyDescription.prototype, "softwareEnforced", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: AuthorizationList })], KeyDescription.prototype, "teeEnforced", void 0);
+	var KeyMintKeyDescription = class KeyMintKeyDescription {
+		attestationVersion = Version.keyMint4;
+		attestationSecurityLevel = SecurityLevel.software;
+		keyMintVersion = 0;
+		keyMintSecurityLevel = SecurityLevel.software;
+		attestationChallenge = new asn1_schema_1.OctetString();
+		uniqueId = new asn1_schema_1.OctetString();
+		softwareEnforced = new AuthorizationList();
+		hardwareEnforced = new AuthorizationList();
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+		toLegacyKeyDescription() {
+			return new KeyDescription({
+				attestationVersion: this.attestationVersion,
+				attestationSecurityLevel: this.attestationSecurityLevel,
+				keymasterVersion: this.keyMintVersion,
+				keymasterSecurityLevel: this.keyMintSecurityLevel,
+				attestationChallenge: this.attestationChallenge,
+				uniqueId: this.uniqueId,
+				softwareEnforced: this.softwareEnforced,
+				teeEnforced: this.hardwareEnforced
+			});
+		}
+		static fromLegacyKeyDescription(keyDesc) {
+			return new KeyMintKeyDescription({
+				attestationVersion: keyDesc.attestationVersion,
+				attestationSecurityLevel: keyDesc.attestationSecurityLevel,
+				keyMintVersion: keyDesc.keymasterVersion,
+				keyMintSecurityLevel: keyDesc.keymasterSecurityLevel,
+				attestationChallenge: keyDesc.attestationChallenge,
+				uniqueId: keyDesc.uniqueId,
+				softwareEnforced: keyDesc.softwareEnforced,
+				hardwareEnforced: keyDesc.teeEnforced
+			});
+		}
+	};
+	exports.KeyMintKeyDescription = KeyMintKeyDescription;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], KeyMintKeyDescription.prototype, "attestationVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], KeyMintKeyDescription.prototype, "attestationSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], KeyMintKeyDescription.prototype, "keyMintVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], KeyMintKeyDescription.prototype, "keyMintSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], KeyMintKeyDescription.prototype, "attestationChallenge", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], KeyMintKeyDescription.prototype, "uniqueId", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: AuthorizationList })], KeyMintKeyDescription.prototype, "softwareEnforced", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: AuthorizationList })], KeyMintKeyDescription.prototype, "hardwareEnforced", void 0);
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@peculiar+asn1-android@2.11.0/node_modules/@peculiar/asn1-android/build/cjs/nonstandard.js
+var require_nonstandard = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var NonStandardAuthorizationList_1;
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.NonStandardKeyMintKeyDescription = exports.NonStandardKeyDescription = exports.NonStandardAuthorizationList = exports.NonStandardAuthorization = void 0;
+	const tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+	const asn1_schema_1 = require_cjs$1();
+	const key_description_1 = require_key_description();
+	let NonStandardAuthorization = class NonStandardAuthorization extends key_description_1.AuthorizationList {};
+	exports.NonStandardAuthorization = NonStandardAuthorization;
+	exports.NonStandardAuthorization = NonStandardAuthorization = tslib_1.__decorate([(0, asn1_schema_1.AsnType)({ type: asn1_schema_1.AsnTypeTypes.Choice })], NonStandardAuthorization);
+	let NonStandardAuthorizationList = NonStandardAuthorizationList_1 = class NonStandardAuthorizationList extends asn1_schema_1.AsnArray {
+		constructor(items) {
+			super(items);
+			Object.setPrototypeOf(this, NonStandardAuthorizationList_1.prototype);
+		}
+		findProperty(key) {
+			const prop = this.find((o) => o[key] !== void 0);
+			if (prop) return prop[key];
+		}
+	};
+	exports.NonStandardAuthorizationList = NonStandardAuthorizationList;
+	exports.NonStandardAuthorizationList = NonStandardAuthorizationList = NonStandardAuthorizationList_1 = tslib_1.__decorate([(0, asn1_schema_1.AsnType)({
+		type: asn1_schema_1.AsnTypeTypes.Sequence,
+		itemType: NonStandardAuthorization
+	})], NonStandardAuthorizationList);
+	var NonStandardKeyDescription = class {
+		attestationVersion = key_description_1.Version.KM4;
+		attestationSecurityLevel = key_description_1.SecurityLevel.software;
+		keymasterVersion = 0;
+		keymasterSecurityLevel = key_description_1.SecurityLevel.software;
+		attestationChallenge = new asn1_schema_1.OctetString();
+		uniqueId = new asn1_schema_1.OctetString();
+		softwareEnforced = new NonStandardAuthorizationList();
+		teeEnforced = new NonStandardAuthorizationList();
+		get keyMintVersion() {
+			return this.keymasterVersion;
+		}
+		set keyMintVersion(value) {
+			this.keymasterVersion = value;
+		}
+		get keyMintSecurityLevel() {
+			return this.keymasterSecurityLevel;
+		}
+		set keyMintSecurityLevel(value) {
+			this.keymasterSecurityLevel = value;
+		}
+		get hardwareEnforced() {
+			return this.teeEnforced;
+		}
+		set hardwareEnforced(value) {
+			this.teeEnforced = value;
+		}
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.NonStandardKeyDescription = NonStandardKeyDescription;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], NonStandardKeyDescription.prototype, "attestationVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], NonStandardKeyDescription.prototype, "attestationSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], NonStandardKeyDescription.prototype, "keymasterVersion", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Enumerated })], NonStandardKeyDescription.prototype, "keymasterSecurityLevel", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], NonStandardKeyDescription.prototype, "attestationChallenge", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.OctetString })], NonStandardKeyDescription.prototype, "uniqueId", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: NonStandardAuthorizationList })], NonStandardKeyDescription.prototype, "softwareEnforced", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: NonStandardAuthorizationList })], NonStandardKeyDescription.prototype, "teeEnforced", void 0);
+	let NonStandardKeyMintKeyDescription = class NonStandardKeyMintKeyDescription extends NonStandardKeyDescription {
+		constructor(params = {}) {
+			if ("keymasterVersion" in params && !("keyMintVersion" in params)) params.keyMintVersion = params.keymasterVersion;
+			if ("keymasterSecurityLevel" in params && !("keyMintSecurityLevel" in params)) params.keyMintSecurityLevel = params.keymasterSecurityLevel;
+			if ("teeEnforced" in params && !("hardwareEnforced" in params)) params.hardwareEnforced = params.teeEnforced;
+			super(params);
+		}
+	};
+	exports.NonStandardKeyMintKeyDescription = NonStandardKeyMintKeyDescription;
+	exports.NonStandardKeyMintKeyDescription = NonStandardKeyMintKeyDescription = tslib_1.__decorate([(0, asn1_schema_1.AsnType)({ type: asn1_schema_1.AsnTypeTypes.Sequence })], NonStandardKeyMintKeyDescription);
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@peculiar+asn1-android@2.11.0/node_modules/@peculiar/asn1-android/build/cjs/attestation.js
+var require_attestation = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.AttestationApplicationId = exports.AttestationPackageInfo = void 0;
+	const tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+	const asn1_schema_1 = require_cjs$1();
+	var AttestationPackageInfo = class {
+		packageName;
+		version;
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.AttestationPackageInfo = AttestationPackageInfo;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.OctetString })], AttestationPackageInfo.prototype, "packageName", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({ type: asn1_schema_1.AsnPropTypes.Integer })], AttestationPackageInfo.prototype, "version", void 0);
+	var AttestationApplicationId = class {
+		packageInfos;
+		signatureDigests;
+		constructor(params = {}) {
+			Object.assign(this, params);
+		}
+	};
+	exports.AttestationApplicationId = AttestationApplicationId;
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		type: AttestationPackageInfo,
+		repeated: "set"
+	})], AttestationApplicationId.prototype, "packageInfos", void 0);
+	tslib_1.__decorate([(0, asn1_schema_1.AsnProp)({
+		type: asn1_schema_1.AsnPropTypes.OctetString,
+		repeated: "set"
+	})], AttestationApplicationId.prototype, "signatureDigests", void 0);
+}));
+(/* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	const tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+	tslib_1.__exportStar(require_key_description(), exports);
+	tslib_1.__exportStar(require_nonstandard(), exports);
+	tslib_1.__exportStar(require_attestation(), exports);
+})))();
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/authentication/verifyAuthenticationResponse.js
+/**
+* Verify that the user has legitimately completed the authentication process
+*
+* **Options:**
+*
+* @param response - Response returned by **@simplewebauthn/browser**'s `startAuthentication()`
+* @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
+* @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
+* @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
+* @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
+* @param expectedType **(Optional)** - The response type expected ('webauthn.get')
+* @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
+* @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements
+* @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
+*/
+async function verifyAuthenticationResponse(options) {
+	const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, expectedTopOrigin, credential, requireUserVerification = true, advancedFIDOConfig } = options;
+	const { id, rawId, type: credentialType, response: assertionResponse } = response;
+	if (!id) throw new Error("Missing credential ID");
+	if (id !== rawId) throw new Error("Credential ID was not base64url-encoded");
+	if (credentialType !== "public-key") throw new Error(`Unexpected credential type ${credentialType}, expected "public-key"`);
+	if (!response) throw new Error("Credential missing response");
+	if (typeof assertionResponse?.clientDataJSON !== "string") throw new Error("Credential response clientDataJSON was not a string");
+	const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
+	const { type, origin, challenge, tokenBinding, crossOrigin, topOrigin } = clientDataJSON;
+	if (Array.isArray(expectedType)) {
+		if (!expectedType.includes(type)) {
+			const joinedExpectedType = expectedType.join(", ");
+			throw new Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`);
+		}
+	} else if (expectedType) {
+		if (type !== expectedType) throw new Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`);
+	} else if (type !== "webauthn.get") throw new Error(`Unexpected authentication response type: ${type}`);
+	if (typeof expectedChallenge === "function") {
+		if (!await expectedChallenge(challenge)) throw new Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`);
+	} else if (challenge !== expectedChallenge) throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
+	if (crossOrigin) {
+		/**
+		* TODO: Since Safari doesn't support `topOrigin` as of May 2026, only check this when
+		* `topOrigin` is available for now.
+		*/
+		if (topOrigin) {
+			if (!expectedTopOrigin)
+ /**
+			* If `expectedTopOrigin` is not set, this should be considered an unexpected cross-origin
+			* request. Reject the response while helping the RP understand how they need to update this
+			* method call if they want to support verification of such WebAuthn authentication requests.
+			*/
+			throw new Error(`Detected cross-origin authentication response from top origin of "${topOrigin}", but a value for \`expectedTopOrigin\` was not specified when calling \`verifyAuthenticationResponse()\``);
+			if (Array.isArray(expectedTopOrigin)) {
+				if (!expectedTopOrigin.includes(topOrigin)) {
+					const joinedExpectedTopOrigin = expectedTopOrigin.join(", ");
+					throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected one of: ${joinedExpectedTopOrigin}`);
+				}
+			} else if (topOrigin !== expectedTopOrigin) throw new Error(`Unexpected cross-origin authentication response top origin of "${topOrigin}", expected: ${expectedTopOrigin}`);
+		}
+	} else if (topOrigin)
+ /**
+	* If `topOrigin` is set despite `crossOrigin` being false, this is an unexpected request.
+	*
+	* See https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin.
+	*/
+	throw new Error(`Unexpected top origin of "${topOrigin}" within a non-cross-origin authentication response. This error should be reported to the browser vendor as a WebAuthn specification violation with a link to https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin`);
+	if (Array.isArray(expectedOrigin)) {
+		if (!expectedOrigin.includes(origin)) {
+			const joinedExpectedOrigin = expectedOrigin.join(", ");
+			throw new Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`);
+		}
+	} else if (origin !== expectedOrigin) throw new Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);
+	if (!isBase64URL(assertionResponse.authenticatorData)) throw new Error("Credential response authenticatorData was not a base64url string");
+	if (!isBase64URL(assertionResponse.signature)) throw new Error("Credential response signature was not a base64url string");
+	if (assertionResponse.userHandle && typeof assertionResponse.userHandle !== "string") throw new Error("Credential response userHandle was not a string");
+	if (tokenBinding) {
+		if (typeof tokenBinding !== "object") throw new Error("ClientDataJSON tokenBinding was not an object");
+		if ([
+			"present",
+			"supported",
+			"notSupported"
+		].indexOf(tokenBinding.status) < 0) throw new Error(`Unexpected tokenBinding status ${tokenBinding.status}`);
+	}
+	const authDataBuffer = toBuffer(assertionResponse.authenticatorData);
+	const { rpIdHash, flags, counter, extensionsData } = parseAuthenticatorData(authDataBuffer);
+	let expectedRPIDs = [];
+	if (typeof expectedRPID === "string") expectedRPIDs = [expectedRPID];
+	else expectedRPIDs = expectedRPID;
+	const matchedRPID = await matchExpectedRPID(rpIdHash, expectedRPIDs);
+	if (advancedFIDOConfig !== void 0) {
+		const { userVerification: fidoUserVerification } = advancedFIDOConfig;
+		/**
+		* Use FIDO Conformance-defined rules for verifying UP and UV flags
+		*/
+		if (fidoUserVerification === "required") {
+			if (!flags.uv) throw new Error("User verification required, but user could not be verified");
+		} else if (fidoUserVerification === "preferred" || fidoUserVerification === "discouraged") {}
+	} else {
+		/**
+		* Use WebAuthn spec-defined rules for verifying UP and UV flags
+		*/
+		if (!flags.up) throw new Error("User not present during authentication");
+		if (requireUserVerification && !flags.uv) throw new Error("User verification required, but user could not be verified");
+	}
+	const clientDataHash = await toHash(toBuffer(assertionResponse.clientDataJSON));
+	const signatureBase = concat([authDataBuffer, clientDataHash]);
+	const signature = toBuffer(assertionResponse.signature);
+	if ((counter > 0 || credential.counter > 0) && counter <= credential.counter) throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
+	const pubKeyAlg = decodeCredentialPublicKey(credential.publicKey).get(COSEKEYS.alg);
+	if (typeof pubKeyAlg !== "number") throw new Error("Credential public key was missing numeric alg");
+	if (isPQCCOSEAlg(pubKeyAlg) && !SettingsService.runtimeSupportsPQC()) throw new PQCNotSupportedError(pubKeyAlg);
+	const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
+	return {
+		verified: await verifySignature({
+			signature,
+			data: signatureBase,
+			credentialPublicKey: credential.publicKey
+		}),
+		authenticationInfo: {
+			newCounter: counter,
+			credentialID: credential.id,
+			userVerified: flags.uv,
+			credentialDeviceType,
+			credentialBackedUp,
+			authenticatorExtensionResults: extensionsData,
+			origin: clientDataJSON.origin,
+			rpID: matchedRPID
+		}
+	};
+}
+//#endregion
+export { verifyAuthenticationResponse };