@deslop/auth 0.1.1250 → 0.1.1256

package/dist/server.js

@@ -6919,7 +6919,7 @@ const keys$1 = (self) => Object.keys(self);
 * @category mutations
 * @since 2.0.0
 */
-const set$6 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$7 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	return {
 		...self,
 		[key]: value
@@ -16429,7 +16429,7 @@ const make$79 = (...entries) => fromIterable$2(entries);
 */
 const fromIterable$2 = (entries) => {
 	const self = empty$10();
-	for (const [key, value] of entries) set$5(self, key, value);
+	for (const [key, value] of entries) set$6(self, key, value);
 	return self;
 };
 /**
@@ -16521,7 +16521,7 @@ const getFromBucket = (self, bucket, key) => {
 * @category mutations
 * @since 2.0.0
 */
-const set$5 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$6 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	if (self.backing.has(key) || isSimpleKey(key)) {
 		self.backing.set(key, value);
 		return self;
@@ -23909,7 +23909,7 @@ const make$75 = (value) => {
 * @category mutations
 * @since 2.0.0
 */
-const set$4 = /*#__PURE__*/ dual(2, (self, value) => {
+const set$5 = /*#__PURE__*/ dual(2, (self, value) => {
 	self.current = value;
 	return self;
 });
@@ -24481,7 +24481,7 @@ const makeAtomicUnbounded = (options) => {
 * @since 2.0.0
 */
 const shutdown$1 = (self) => uninterruptible(withFiber((fiber) => {
-	set$4(self.shutdownFlag, true);
+	set$5(self.shutdownFlag, true);
 	return close(self.scope, interrupt$2(fiber.id)).pipe(andThen(self.strategy.shutdown), when$2(self.shutdownHook.open), asVoid);
 }));
 /**
@@ -24637,7 +24637,7 @@ const subscribe = (self) => uninterruptible(contextWith((services) => {
 	return addFinalizer$1(scope, unsubscribe(subscription)).pipe(andThen(addFinalizerExit(localScope, (exit) => close(scope, exit))), as(subscription));
 }));
 const unsubscribe = (self) => uninterruptible(withFiber((state) => {
-	set$4(self.shutdownFlag, true);
+	set$5(self.shutdownFlag, true);
 	return forEach$1(takeAll$2(self.pollers), (d) => interruptWith(d, state.id), {
 		discard: true,
 		concurrency: "unbounded"
@@ -28735,7 +28735,7 @@ const get$10 = /*#__PURE__*/ dual(2, (self, key) => uninterruptibleMask((restore
 			refCount: 1
 		};
 		entry.finalizer = release$1(self, key, entry);
-		set$5(state.map, key, entry);
+		set$6(state.map, key, entry);
 		const context = new Map(self.context.mapUnsafe);
 		parent.context.mapUnsafe.forEach((value, key) => {
 			context.set(key, value);
@@ -37729,6 +37729,42 @@ const make$58 = (value) => sync(() => makeUnsafe$2(value));
 */
 const get$7 = (self) => sync(() => self.ref.current);
 /**
+* Sets the value of the Ref to the specified value.
+*
+* **When to use**
+*
+* Use to replace the current `Ref` value with a known value.
+*
+* **Example** (Setting a value)
+*
+* ```ts import.meta.vitest
+* import { Effect, Ref } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const ref = yield* Ref.make(0)
+*   yield* Ref.set(ref, 42)
+*   return yield* Ref.get(ref)
+* })
+*
+* const program2 = Effect.gen(function*() {
+*   const ref = yield* Ref.make(0)
+*   yield* Ref.set(ref, 100)
+*   return yield* Ref.get(ref)
+* })
+*
+* await Effect.runPromise(program) // => 42
+* await Effect.runPromise(program2) // => 100
+* ```
+*
+* @see {@link getAndSet} for setting while returning the previous value
+* @see {@link setAndGet} for setting while returning the new value
+*
+* @stability stable
+* @category mutations
+* @since 2.0.0
+*/
+const set$4 = /*#__PURE__*/ dual(2, (self, value) => sync(() => set$5(self.ref, value)));
+/**
 * Modifies the value of the Ref atomically using the given function.
 *
 * **When to use**
@@ -38143,7 +38179,7 @@ const makeCookieUnsafe = (name, value, options) => getOrThrow(makeCookie(name, v
 * @category combinators
 * @since 4.0.0
 */
-const setUnsafe$1 = /*#__PURE__*/ dual((args) => isCookies(args[0]), (self, name, value, options) => fromReadonlyRecord(set$6(self.cookies, name, makeCookieUnsafe(name, value, options))));
+const setUnsafe$1 = /*#__PURE__*/ dual((args) => isCookies(args[0]), (self, name, value, options) => fromReadonlyRecord(set$7(self.cookies, name, makeCookieUnsafe(name, value, options))));
 /**
 * Adds an expired cookie to a Cookies object, throwing an error if invalid
 *
@@ -47658,6 +47694,25 @@ function Redacted$1(value, options) {
 	});
 	return make$51(schema.ast, { value });
 }
+/**
+* Decodes a value and wraps it in `Redacted<A>`. Unlike {@link Redacted} which
+* expects the input to already be a `Redacted` instance, this schema decodes
+* the raw value and wraps it.
+*
+* @see {@link Redacted} for schemas whose input is already a `Redacted` value.
+* @stability stable
+* @category schemas
+* @since 4.0.0
+*/
+function RedactedFromValue(value, options) {
+	return decodeTo(Redacted$1(toType(value), {
+		label: options?.label,
+		disallowJsonEncode: options?.disallowEncode
+	}), {
+		decode: transform$3((t) => make$61(t, { label: options?.label })),
+		encode: options?.disallowEncode ? forbidden((oe) => "Cannot encode Redacted" + (isSome(oe) && typeof oe.value.label === "string" ? ` with label: "${oe.value.label}"` : "")) : transform$3(value$2)
+	})(value);
+}
 const immerable = /*#__PURE__*/ globalThis.Symbol.for("immer-draftable");
 const payloadToken = {};
 function makeClass(Inherited, identifier, struct$1, annotations, proto) {
@@ -49007,6 +49062,14 @@ const compressBody = /*#__PURE__*/ dual((args) => isHttpClientRequest(args[0]),
 	return map$5(compressBody$1(self.body, algorithm, options), (body) => body === self.body ? self : makeWith$2(self.method, self.url, self.urlParams, self.hash, set$3(updateContentLength(self.headers, body), "content-encoding", algorithm), body));
 });
 /**
+* Encodes a value as a JSON request body and sets it on the request, failing with `HttpBodyError` if encoding fails.
+*
+* @stability unstable
+* @category combinators
+* @since 4.0.0
+*/
+const bodyJson = /*#__PURE__*/ dual(2, (self, body) => map$5(json$1(body), (body) => setBody$1(self, body)));
+/**
 * Sets a JSON request body using unsafe JSON encoding.
 *
 * **When to use**
@@ -49580,6 +49643,14 @@ const endSpanWithStatusError = (fiber, span, request, response) => {
 	span.end(fiber.getRef(TracerTimingEnabled) ? fiber.getRef(Clock).currentTimeNanosUnsafe() : BigInt(0), exit);
 };
 /**
+* Appends an effectful transformation of the request object before sending it.
+*
+* @stability unstable
+* @category mapping
+* @since 4.0.0
+*/
+const mapRequestEffect = /*#__PURE__*/ dual(2, (self, f) => makeWith$1(self.postprocess, (request) => flatMap$2(self.preprocess(request), f)));
+/**
 * Retries common transient errors, such as rate limiting, timeouts or network issues.
 *
 * **When to use**
@@ -68684,7 +68755,7 @@ const get$2 = /*#__PURE__*/ dual(2, (self, key) => withFiber$1((fiber) => {
 	if (isSome(oentry)) {
 		remove$5(self.map, key);
 		if (!hasExpired(oentry.value, fiber)) {
-			set$5(self.map, key, oentry.value);
+			set$6(self.map, key, oentry.value);
 			return oentry.value.await(fiber);
 		}
 	}
@@ -68704,7 +68775,7 @@ const get$2 = /*#__PURE__*/ dual(2, (self, key) => withFiber$1((fiber) => {
 		} else if (isFinite$1(ttl)) entry.expiresAt = fiber.getRef(ClockRef).currentTimeMillisUnsafe() + toMillis(ttl);
 	});
 	const exit = entry.fiber.pollUnsafe();
-	if (!skipCache && (exit === void 0 || !exitHasInterrupts(exit))) set$5(self.map, key, entry);
+	if (!skipCache && (exit === void 0 || !exitHasInterrupts(exit))) set$6(self.map, key, entry);
 	if (Number.isFinite(self.capacity)) checkCapacity(self);
 	return entry.await(fiber);
 }));
@@ -68869,7 +68940,7 @@ const set = /*#__PURE__*/ dual(3, (self, key, value) => withFiber$1((fiber) => {
 		return void_$3;
 	}
 	entry.expiresAt = isFinite$1(ttl) ? fiber.getRef(ClockRef).currentTimeMillisUnsafe() + toMillis(ttl) : void 0;
-	set$5(self.map, key, entry);
+	set$6(self.map, key, entry);
 	checkCapacity(self);
 	return void_$3;
 }));
@@ -89440,6 +89511,71 @@ function failureOptions(error, status) {
 }
 var CurrentUser = class extends Service$1()("@deslop/runtime/auth/lib/utils/CurrentUser") {};
 var RpcAuth = class extends Service()("@deslop/runtime/auth/lib/utils/RpcAuth", { error: AuthError }) {};
+Literals([
+	"anthropic",
+	"openrouter",
+	"opencode-zen",
+	"opencode-go"
+]);
+// ../../packages/runtime/src/ai/service.ts
+var AiUnavailable = class extends TaggedError()("AiUnavailable", { message: String$6 }) {};
+fromJsonString(Struct({ error: Struct({ message: String$6 }) }));
+var AiGateway = class AiGateway extends Service$1()("@deslop/runtime/ai/service/AiGateway") {
+	static layer = effect(this, gen(function* () {
+		const gateway = yield* option(String$5("GATEWAY_URL"));
+		const local = yield* localAuth;
+		const app = yield* String$5("APP_URL");
+		const client = yield* HttpClient;
+		const store = toSchemaStore(yield* KeyValueStore, Record$1(String$6, RedactedFromValue(String$6)));
+		const grants = yield* make$58(getOrElse(yield* store.get("ai-gateway-grants"), () => ({})));
+		const lock = yield* make$71(1);
+		return AiGateway.of({
+			apiUrl: (provider) => match$8(gateway, {
+				onNone: () => fail$7(AiUnavailable.make({ message: "Start the app with --gateway" })),
+				onSome: (url) => succeed$5(`${url}/ai/${provider}${match$1(provider === "openrouter", {
+					onFalse: () => "",
+					onTrue: () => "/v1"
+				})}`)
+			}),
+			authorize: (userId) => (http) => pipe(mapRequestEffect(http, (request) => gen(function* () {
+				if (local) return request;
+				const token = (yield* get$7(grants))[userId];
+				if (token === void 0) return yield* new HttpClientError({ reason: new TransportError({
+					description: "AI access is unavailable; sign in again to enroll with Gateway",
+					request
+				}) });
+				return setHeader$1(request, "authorization", `Bearer ${value$2(token)}`);
+			})), tap((response) => pipe(gen(function* () {
+				if (local || response.headers["x-gateway-grant-refused"] === void 0 || !exists(gateway, (url) => startsWith(`${url}/ai/`)(response.request.url))) return;
+				const current = yield* get$7(grants);
+				const token = current[userId];
+				if (token === void 0 || response.request.headers["authorization"] !== `Bearer ${value$2(token)}`) return;
+				const next = remove$6(current, userId);
+				yield* pipe(store.set("ai-gateway-grants", next), ignore$1({
+					log: "Warn",
+					message: "The rejected AI grant could not be removed from storage"
+				}));
+				yield* set$4(grants, next);
+			}), withPermit(lock)))),
+			enroll: fnUntraced(function* (userId, headers) {
+				return yield* pipe(gen(function* () {
+					if (local || isNone(gateway) || (yield* get$7(grants))[userId] !== void 0) return;
+					const response = yield* client.execute(yield* bodyJson(post(`${getOrElse(gateway, () => "")}/ai/grants`, { headers: match$1(headers["authorization"] !== void 0, {
+						onFalse: () => ({ cookie: headers["cookie"] ?? "" }),
+						onTrue: () => ({ authorization: headers["authorization"] })
+					}) }), { app }));
+					const result = yield* schemaBodyJson$1(Struct({ token: String$6 }))(response);
+					const next = {
+						...yield* get$7(grants),
+						[userId]: make$61(result.token)
+					};
+					yield* store.set("ai-gateway-grants", next);
+					yield* set$4(grants, next);
+				}), withPermit(lock), timeout$1("10 seconds"), catch_$2(() => logWarning("AI Gateway enrollment failed")));
+			})
+		});
+	}));
+};
 // ../../packages/runtime/src/auth/service.ts
 function rejected(message) {
 	return mapError$2((cause) => {
@@ -89458,12 +89594,18 @@ function rejected(message) {
 function developer() {
 	return succeed$5(DEVELOPER);
 }
+function enrolled(user, headers) {
+	return gen(function* () {
+		const gateway = getOrUndefined(yield* context(), AiGateway);
+		if (gateway !== void 0) yield* gateway.enroll(user.id, headers);
+	});
+}
 const unavailable = text("The authorization service is temporarily unavailable; retry later", {
 	headers: { "retry-after": "5" },
 	status: 503
 });
 var Auth = class Auth extends Service$1()("@deslop/runtime/auth/service/Auth") {
-	static makeContext = (auth) => pipe(make$85(Auth, auth), add$1(RpcAuth, RpcAuth.of((effect, request) => pipe(auth.user(request.headers), tap$1(() => {
+	static makeContext = (auth) => pipe(make$85(Auth, auth), add$1(RpcAuth, RpcAuth.of((effect, request) => pipe(auth.user(request.headers), tap$1((user) => enrolled(user, request.headers)), tap$1(() => {
 		if (isStreamSchema(request.rpc.successSchema)) return annotateCurrentSpan("rpc.stream", true);
 		return void_$1;
 	}), flatMap$2((user) => raceFirst(provideService(effect, CurrentUser, user), pipe(delay(auth.user(request.headers), "5 minutes"), retry({ while: (error) => error.error === "temporarily_unavailable" }), forever)))))));
@@ -89498,6 +89640,7 @@ middleware$1()(gen(function* () {
 			if (user.failure.error === "temporarily_unavailable") return unavailable;
 			return text("Sign in first", { status: 401 });
 		}
+		yield* enrolled(user.success, (yield* HttpServerRequest).headers);
 		return yield* provideService(app, CurrentUser, user.success);
 	});
 }));
@@ -89520,6 +89663,7 @@ function layerMcpAuth(resource) {
 					status: 401
 				});
 			}
+			yield* enrolled(user.success, headers);
 			return yield* provideService(app, CurrentUser, user.success);
 		});
 	})).layer;
@@ -89910,6 +90054,11 @@ const SETTINGS = {
 		flag: "auth",
 		schema: SecureOrigin
 	},
+	GATEWAY_URL: {
+		description: "Deslop Gateway origin for AI calls",
+		flag: "gateway",
+		schema: Origin$1
+	},
 	HOST: {
 		description: `Listen address; defaults to ${DEFAULT_HOST}`,
 		flag: "host",
@@ -89945,7 +90094,7 @@ function server(app) {
 	return pipe(serve(pipe(mergeAll$1(app.routes, layerRoutes, layerIcon(app.icon), layerWeb, layerAnnounce), provide$2(match$8(fromUndefinedOr(app.middleware), {
 		onNone: () => empty$11,
 		onSome: (middleware) => middleware$1()(middleware).layer
-	})), provide$2(Auth.layer)), {
+	})), provide$2(Auth.layer), provideMerge(pipe(AiGateway.layer, provide$2(layerDataStore)))), {
 		disableLogger: true,
 		middleware: guard
 	}), provide$2(mergeAll$1(layerProtocol, match$1(app.telemetry === false, {
@@ -90536,7 +90685,7 @@ base64.validate = (encoded, urlMode) => {
 	}
 };
 base64.base64 = base64;
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoBase64URL.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoBase64URL.js
 /**
 * A runtime-agnostic collection of methods for working with Base64URL encoding
 * @module
@@ -90946,7 +91095,7 @@ function encodeCBOR(data) {
 	}
 	return output;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCBOR.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCBOR.js
 /**
 * A runtime-agnostic collection of methods for working with CBOR encoding
 * @module
@@ -90978,7 +91127,7 @@ function decodeFirst(input) {
 function encode(input) {
 	return encodeCBOR(input);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/cose.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/cose.js
 /**
 * A type guard for determining if a COSE public key is an OKP key pair
 */
@@ -91088,7 +91237,7 @@ function isPQCCOSEAlg(alg) {
 		COSEALG.ML_DSA_87
 	].indexOf(alg) >= 0;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.js
 /**
 * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
 *
@@ -91115,7 +91264,7 @@ function mapCoseAlgToWebCryptoHashAlgName(alg) {
 	].indexOf(alg) >= 0) return "SHA-512";
 	throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto hash alg name`);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/getWebCrypto.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/getWebCrypto.js
 let webCrypto = void 0;
 /**
 * Try to get an instance of the Crypto API from the current runtime. Should support Node,
@@ -91160,7 +91309,7 @@ const _getWebCryptoInternals = {
 		webCrypto = newCrypto;
 	}
 };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/digest.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/digest.js
 /**
 * Generate a digest of the provided data.
 *
@@ -91173,7 +91322,7 @@ async function digest(data, algorithm) {
 	const hashed = await WebCrypto.subtle.digest(subtleAlgorithm, data);
 	return new Uint8Array(hashed);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/getRandomValues.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/getRandomValues.js
 /**
 * Fill up the provided bytes array with random bytes equal to its length.
 *
@@ -91183,7 +91332,7 @@ async function getRandomValues(array) {
 	(await getWebCrypto()).getRandomValues(array);
 	return array;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/convertAAGUIDToString.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/convertAAGUIDToString.js
 /**
 * Convert the aaguid buffer in authData into a UUID string
 */
@@ -91197,7 +91346,7 @@ function convertAAGUIDToString(aaguid) {
 		hex.slice(20, 32)
 	].join("-");
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/convertCOSEtoPKCS.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/convertCOSEtoPKCS.js
 /**
 * Takes COSE-encoded public key and converts it to PKCS key
 */
@@ -91214,7 +91363,7 @@ function convertCOSEtoPKCS(cosePublicKey) {
 	]);
 	return concat([tag, x]);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/decodeAttestationObject.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/decodeAttestationObject.js
 /**
 * Convert an AttestationObject buffer to a proper object
 *
@@ -91228,7 +91377,7 @@ function decodeAttestationObject(attestationObject) {
 * @ignore Don't include this in docs output
 */
 const _decodeAttestationObjectInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/decodeClientDataJSON.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/decodeClientDataJSON.js
 /**
 * Decode an authenticator's base64url-encoded clientDataJSON to JSON
 */
@@ -91242,7 +91391,7 @@ function decodeClientDataJSON(data) {
 * @ignore Don't include this in docs output
 */
 const _decodeClientDataJSONInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/decodeCredentialPublicKey.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/decodeCredentialPublicKey.js
 function decodeCredentialPublicKey(publicKey) {
 	return _decodeCredentialPublicKeyInternals.stubThis(decodeFirst(publicKey));
 }
@@ -91251,7 +91400,7 @@ function decodeCredentialPublicKey(publicKey) {
 * @ignore Don't include this in docs output
 */
 const _decodeCredentialPublicKeyInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/generateChallenge.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/generateChallenge.js
 /**
 * Generate a suitably random value to be used as an attestation or assertion challenge
 */
@@ -91273,7 +91422,7 @@ async function generateChallenge() {
 * @ignore Don't include this in docs output
 */
 const _generateChallengeInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/generateUserID.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/generateUserID.js
 /**
 * Generate a suitably random value to be used as user ID
 */
@@ -99678,7 +99827,7 @@ var require_cjs$12 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	tslib_1.__exportStar(require_types$3(), exports);
 	tslib_1.__exportStar(require_validity(), exports);
 }));
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/getCertificateInfo.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/getCertificateInfo.js
 var import_cjs$4 = require_cjs$13();
 var import_cjs$5 = require_cjs$12();
 const issuerSubjectIDKey = {
@@ -107916,15 +108065,15 @@ var import_x509_cjs = require_x509_cjs();
 * A simple method for requesting data via standard `fetch`. Should work
 * across multiple runtimes.
 */
-function fetch(url) {
-	return _fetchInternals.stubThis(url);
+function fetch(...args) {
+	return _fetchInternals.stubThis(...args);
 }
 /**
 * Make it possible to stub the return value during testing
 * @ignore Don't include this in docs output
 */
-const _fetchInternals = { stubThis: (url) => globalThis.fetch(url) };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/isCertRevoked.js
+const _fetchInternals = { stubThis: (...args) => globalThis.fetch(...args) };
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/isCertRevoked.js
 const cacheRevokedCerts = {};
 /**
 * A method to pull a CRL from a certificate and compare its serial number to the list of revoked
@@ -107992,7 +108141,7 @@ async function getIssuerKeyIdentifier(issuer) {
 		fromExtension: false
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/decodeAuthenticatorExtensions.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/decodeAuthenticatorExtensions.js
 /**
 * Convert authenticator extension data buffer to a proper object
 *
@@ -108018,7 +108167,7 @@ function convertMapToObjectDeep(input) {
 	else mapped[key] = value;
 	return mapped;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/parseAuthenticatorData.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/parseAuthenticatorData.js
 /**
 * Make sense of the authData buffer contained in an Attestation
 */
@@ -108108,16 +108257,16 @@ function parseAuthenticatorData(authData) {
 * @ignore Don't include this in docs output
 */
 const _parseAuthenticatorDataInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/toHash.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/toHash.js
 /**
-* Returns hash digest of the given data, using the given algorithm when provided. Defaults to using
-* SHA-256.
+* Returns the hash of the given data, using the given algorithm when provided. If `data` is
+* a string, then it's treated like a UTF-8 string. Defaults to hashing using SHA-256.
 */
 function toHash(data, algorithm = -7) {
 	if (typeof data === "string") data = fromUTF8String(data);
 	return digest(data, algorithm);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js
 /**
 * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
 *
@@ -108148,7 +108297,7 @@ function mapCoseAlgToWebCryptoKeyAlgName(alg) {
 	else if ([COSEALG.ML_DSA_87].indexOf(alg) >= 0) return "ML-DSA-87";
 	throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/errors/index.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/errors/index.js
 /**
 * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
 */
@@ -108174,7 +108323,7 @@ var PQCNotSupportedError = class extends SimpleWebAuthnError {
 		});
 	}
 };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/validateCertificatePath.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/validateCertificatePath.js
 /**
 * Traverse an array of PEM certificates and ensure they form a proper chain
 * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -108294,7 +108443,7 @@ function assertCertIsWithinValidTimeWindow(certificate) {
 	const now = new Date(Date.now());
 	if (certNotBefore > now || certNotAfter < now) throw new Error("Certificate is not yet valid or expired");
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/mapX509SignatureAlgToCOSEAlg.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/mapX509SignatureAlgToCOSEAlg.js
 var import_cjs$1 = require_cjs$9();
 var import_cjs$2 = require_cjs$8();
 var import_cjs$3 = require_cjs$2();
@@ -108316,7 +108465,7 @@ function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
 	else throw new Error(`Unable to map X.509 signature algorithm ${signatureAlgorithm} to a COSE algorithm`);
 	return alg;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/convertX509PublicKeyToCOSE.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/convertX509PublicKeyToCOSE.js
 function convertX509PublicKeyToCOSE(x509Certificate) {
 	let cosePublicKey = /* @__PURE__ */ new Map();
 	const { tbsCertificate } = import_cjs$4.AsnParser.parse(x509Certificate, import_cjs$5.Certificate);
@@ -108384,7 +108533,7 @@ function convertX509PublicKeyToCOSE(x509Certificate) {
 	} else throw new Error(`Certificate public key contained unexpected algorithm ID ${publicKeyAlgorithmID}`);
 	return cosePublicKey;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/verifySignature.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/verifySignature.js
 /**
 * Verify an authenticator's signature
 */
@@ -108407,7 +108556,7 @@ function verifySignature(opts) {
 * @ignore Don't include this in docs output
 */
 const _verifySignatureInternals = { stubThis: (value) => value };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/metadata/parseJWT.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/metadata/parseJWT.js
 /**
 * Process a JWT into Javascript-friendly data structures
 */
@@ -108419,7 +108568,7 @@ function parseJWT(jwt) {
 		parts[2]
 	];
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/mapJWSAlgToCOSEAlg.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/mapJWSAlgToCOSEAlg.js
 /**
 * Map JWS algorithms to COSE algorithm IDs
 *
@@ -108436,7 +108585,7 @@ function mapJWSAlgToCOSEAlg(alg) {
 	else throw new Error(`Unable to map JWS algorithm "${alg}" to a COSE algorithm`);
 	return algCOSE;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/importJWKKey.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/importJWKKey.js
 /**
 * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
 * signature verification
@@ -108446,7 +108595,7 @@ async function importJWKKey(opts) {
 	const { keyData, algorithm } = opts;
 	return WebCrypto.subtle.importKey("jwk", keyData, algorithm, false, ["verify"]);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyEC2.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyEC2.js
 /**
 * Verify a signature using an EC2 public key
 */
@@ -108493,7 +108642,7 @@ async function verifyEC2(opts) {
 	};
 	return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyRSA.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyRSA.js
 /**
 * Verify a signature using an RSA public key
 */
@@ -108553,7 +108702,7 @@ async function verifyRSA(opts) {
 	});
 	return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/metadata/verifyJWT.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/metadata/verifyJWT.js
 /**
 * Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
 *
@@ -108584,14 +108733,14 @@ function verifyJWT(jwt, leafCert) {
 	const kty = certCOSE.get(COSEKEYS.kty);
 	throw new Error(`JWT verification with public key of kty ${kty} is not supported by this method`);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/convertPEMToBytes.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/convertPEMToBytes.js
 /**
 * Take a certificate in PEM format and convert it to bytes
 */
 function convertPEMToBytes(pem) {
 	return toBuffer(pem.replace("-----BEGIN CERTIFICATE-----", "").replace("-----END CERTIFICATE-----", "").replace(/[\n ]/g, ""), "base64");
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/metadata/verifyMDSBlob.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/metadata/verifyMDSBlob.js
 /**
 * Perform authenticity and integrity verification of a
 * [FIDO Metadata Service (MDS)](https://fidoalliance.org/metadata/)-compatible blob, and then
@@ -108621,7 +108770,7 @@ async function verifyMDSBlob(blob) {
 		payload
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyAKP.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyAKP.js
 /** AKP, a.k.a ML-DSA */
 async function verifyAKP(opts) {
 	const { cosePublicKey, signature, data } = opts;
@@ -108654,7 +108803,7 @@ async function verifyAKP(opts) {
 	}
 	return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyOKP.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verifyOKP.js
 async function verifyOKP(opts) {
 	const { cosePublicKey, signature, data } = opts;
 	const WebCrypto = await getWebCrypto();
@@ -108684,7 +108833,7 @@ async function verifyOKP(opts) {
 	const verifyAlgorithm = { name: _crv };
 	return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/unwrapEC2Signature.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/unwrapEC2Signature.js
 /**
 * In WebAuthn, EC2 signatures are wrapped in ASN.1 structure so we need to peel r and s apart.
 *
@@ -108734,7 +108883,7 @@ function toNormalizedBytes(bytes, componentLength) {
 	else throw new Error(`Invalid signature component length ${bytes.length}, expected ${componentLength}`);
 	return normalizedBytes;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verify.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/verify.js
 /**
 * Verify signatures with their public key. Supports EC2 and RSA public keys.
 */
@@ -108768,7 +108917,7 @@ function verify(opts) {
 	const kty = cosePublicKey.get(COSEKEYS.kty);
 	throw new Error(`Signature verification with public key of kty ${kty} is not supported by this method`);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoUint8Array.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoUint8Array.js
 /**
 * A runtime-agnostic collection of methods for working with Uint8Arrays
 * @module
@@ -108836,7 +108985,7 @@ function fromASCIIString(value) {
 function toDataView(array) {
 	return new DataView(array.buffer, array.byteOffset, array.length);
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/convertCertBufferToPEM.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/convertCertBufferToPEM.js
 /**
 * Convert buffer to an OpenSSL-compatible PEM text format.
 */
@@ -108858,7 +109007,7 @@ function convertCertBufferToPEM(certBuffer) {
 	PEMKey = `-----BEGIN CERTIFICATE-----\n${PEMKey}-----END CERTIFICATE-----\n`;
 	return PEMKey;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js
 /**
 * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
 * for signature verification.
@@ -108872,7 +109021,7 @@ function runtimeSupportsWebCryptoKeyAlg(alg) {
 		return false;
 	}
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/android-safetynet.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/android-safetynet.js
 /**
 * GlobalSign Root CA
 *
@@ -108905,50 +109054,7 @@ DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
 HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
 -----END CERTIFICATE-----
 `;
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/android-key.js
-/**
-* Google Hardware Attestation Root 1
-*
-* Downloaded from https://developer.android.com/training/articles/security-key-attestation#root_certificate
-* (first entry)
-*
-* Valid until 2026-05-24 @ 09:28 PST
-*
-* SHA256 Fingerprint
-* C1:98:4A:3E:F4:5C:1E:2A:91:85:51:DE:10:60:3C:86:F7:05:1B:22:49:C4:89:1C:AE:32:30:EA:BD:0C:97:D5
-*/
-const Google_Hardware_Attestation_Root_1 = `-----BEGIN CERTIFICATE-----
-MIIFYDCCA0igAwIBAgIJAOj6GWMU0voYMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
-BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMTYwNTI2MTYyODUyWhcNMjYwNTI0MTYy
-ODUyWjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B
-AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS
-Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7
-tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj
-nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq
-C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ
-oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O
-JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg
-sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi
-igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M
-RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E
-aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um
-AGMCAwEAAaOBpjCBozAdBgNVHQ4EFgQUNmHhAHyIBQlRi0RsR/8aTMnqTxIwHwYD
-VR0jBBgwFoAUNmHhAHyIBQlRi0RsR/8aTMnqTxIwDwYDVR0TAQH/BAUwAwEB/zAO
-BgNVHQ8BAf8EBAMCAYYwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cHM6Ly9hbmRyb2lk
-Lmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2NybC8wDQYJKoZIhvcNAQELBQAD
-ggIBACDIw41L3KlXG0aMiS//cqrG+EShHUGo8HNsw30W1kJtjn6UBwRM6jnmiwfB
-Pb8VA91chb2vssAtX2zbTvqBJ9+LBPGCdw/E53Rbf86qhxKaiAHOjpvAy5Y3m00m
-qC0w/Zwvju1twb4vhLaJ5NkUJYsUS7rmJKHHBnETLi8GFqiEsqTWpG/6ibYCv7rY
-DBJDcR9W62BW9jfIoBQcxUCUJouMPH25lLNcDc1ssqvC2v7iUgI9LeoM1sNovqPm
-QUiG9rHli1vXxzCyaMTjwftkJLkf6724DFhuKug2jITV0QkXvaJWF4nUaHOTNA4u
-JU9WDvZLI1j83A+/xnAJUucIv/zGJ1AMH2boHqF8CY16LpsYgBt6tKxxWH00XcyD
-CdW2KlBCeqbQPcsFmWyWugxdcekhYsAWyoSf818NUsZdBWBaR/OukXrNLfkQ79Iy
-ZohZbvabO/X+MVT3rriAoKc8oE2Uws6DF+60PV7/WIPjNvXySdqspImSN78mflxD
-qwLqRBYkA3I75qppLGG9rp7UCdRjxMl8ZDBld+7yvHVgt1cVzJx9xnyGCC23Uaic
-MDSXYrB4I4WHXPGjxhZuCuPBLTdOLU8YRvMYdEvYebWHMpvwGCF6bAx3JBpIeOQ1
-wDB5y0USicV3YgYGmi+NZfhA4URSh77Yd6uuJOJENRaNVTzk
------END CERTIFICATE-----
-`;
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/android-key.js
 /**
 * Google Hardware Attestation Root 2
 *
@@ -109037,7 +109143,7 @@ mD/vFDkzF+wm7cyWpQpCVQ==
 /**
 * Google Hardware Attestation Root 4
 *
-* Downloaded from https://developer.android.com/training/articles/security-key-attestation#root_certificate
+* Downloaded from https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate
 * (fourth entry)
 *
 * Valid until 2042-03-15 @ 11:07 PDT
@@ -109077,7 +109183,33 @@ vaI47gC+TNpkgYGkkBT6B/m/U01BuOBBTzhIlMEZq9qkDWuM2cA5kW5V3FJUcfHn
 w1IdYIg2Wxg7yHcQZemFQg==
 -----END CERTIFICATE-----
 `;
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/apple.js
+/**
+* Google Android Key Attestation CA1
+*
+* Downloaded from https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate
+*
+* Valid until 2035-07-15 @ 15:32 PDT
+*
+* SHA256 Fingerprint
+* 6D:9D:B4:CE:6C:5C:0B:29:31:66:D0:89:86:E0:57:74:A8:77:6C:EB:52:5D:9E:43:29:52:0D:E1:2B:A4:BC:C0
+*/
+const Google_Android_Key_Attestation_CA1 = `
+-----BEGIN CERTIFICATE-----
+MIICIjCCAaigAwIBAgIRAISp0Cl7DrWK5/8OgN52BgUwCgYIKoZIzj0EAwMwUjEc
+MBoGA1UEAwwTS2V5IEF0dGVzdGF0aW9uIENBMTEQMA4GA1UECwwHQW5kcm9pZDET
+MBEGA1UECgwKR29vZ2xlIExMQzELMAkGA1UEBhMCVVMwHhcNMjUwNzE3MjIzMjE4
+WhcNMzUwNzE1MjIzMjE4WjBSMRwwGgYDVQQDDBNLZXkgQXR0ZXN0YXRpb24gQ0Ex
+MRAwDgYDVQQLDAdBbmRyb2lkMRMwEQYDVQQKDApHb29nbGUgTExDMQswCQYDVQQG
+EwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABCPaI3FO3z5bBQo8cuiEas4HjqCt
+G/mLFfRT0MsIssPBEEU5Cfbt6sH5yOAxqEi5QagpU1yX4HwnGb7OtBYpDTB57uH5
+Eczm34A5FNijV3s0/f0UPl7zbJcTx6xwqMIRq6NCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFIyuyz7RkOb3NaBqQ5lZuA0QepA
+MAoGCCqGSM49BAMDA2gAMGUCMETfjPO/HwqReR2CS7p0ZWoD/LHs6hDi422opifH
+EUaYLxwGlT9SLdjkVpz0UUOR5wIxAIoGyxGKRHVTpqpGRFiJtQEOOTp/+s1GcxeY
+uR2zh/80lQyu9vAFCj6E4AXc+osmRg==
+-----END CERTIFICATE-----
+`;
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/apple.js
 /**
 * Apple WebAuthn Root CA
 *
@@ -109103,7 +109235,7 @@ jAGGiQIwHFj+dJZYUJR786osByBelJYsVZd2GbHQu209b5RCmGQ21gpSAk9QZW4B
 1bWeT0vT
 -----END CERTIFICATE-----
 `;
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/mds.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/defaultRootCerts/mds.js
 /**
 * GlobalSign Root CA - R3
 *
@@ -109178,7 +109310,7 @@ N3ec592kD3ZDZopD8p/7DEJ4Y9HiD2971KE9dJeFt0g5QdYg/NA6s/rob8SKunE3
 vouXsXgxT7PntgMTzlSdriVZzH81Xwj3QEUxeCp6
 -----END CERTIFICATE-----
 `;
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/settingsService.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/settingsService.js
 var BaseSettingsService = class {
 	constructor() {
 		Object.defineProperty(this, "pemCertificates", {
@@ -109229,10 +109361,10 @@ const SettingsService = new BaseSettingsService();
 SettingsService.setRootCertificates({
 	identifier: "android-key",
 	certificates: [
-		Google_Hardware_Attestation_Root_1,
 		Google_Hardware_Attestation_Root_2,
 		Google_Hardware_Attestation_Root_3,
-		Google_Hardware_Attestation_Root_4
+		Google_Hardware_Attestation_Root_4,
+		Google_Android_Key_Attestation_CA1
 	]
 });
 SettingsService.setRootCertificates({
@@ -109247,7 +109379,7 @@ SettingsService.setRootCertificates({
 	identifier: "mds",
 	certificates: [GlobalSign_Root_CA_R3, GlobalSign_Root_R46]
 });
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/generateRegistrationOptions.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/generateRegistrationOptions.js
 /**
 * Set up some default authenticator selection options as per the latest spec:
 * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria
@@ -109389,7 +109521,7 @@ async function generateRegistrationOptions(options) {
 		hints
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/parseBackupFlags.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/parseBackupFlags.js
 /**
 * Make sense of Bits 3 and 4 in authenticator indicating:
 *
@@ -109414,7 +109546,21 @@ var InvalidBackupFlags = class extends Error {
 		this.name = "InvalidBackupFlags";
 	}
 };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/matchExpectedRPID.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/assertValidExpectedRPID.js
+/**
+* Check the RP ID to make sure it's valid to compare against what's reported in a WebAuthn
+* response.
+*
+* Invalid RP IDs will raise a `SimpleWebAuthnError` with `code: 'BAD_ARGUMENT'`
+*/
+function assertValidExpectedRPID(rpID) {
+	const asciiRPID = new URL(`https://${rpID}`).hostname;
+	if (asciiRPID !== rpID) throw new SimpleWebAuthnError({
+		message: `"${rpID}" is not a valid expected RP ID. Replace it with its ASCII punycode representation "${asciiRPID}" and try again`,
+		code: "BAD_ARGUMENT"
+	});
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/matchExpectedRPID.js
 /**
 * Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
 * that matched the hash in the response.
@@ -109422,6 +109568,7 @@ var InvalidBackupFlags = class extends Error {
 * Raises an `UnexpectedRPIDHash` error if no match is found
 */
 async function matchExpectedRPID(rpIDHash, expectedRPIDs) {
+	for (const rpID of expectedRPIDs) assertValidExpectedRPID(rpID);
 	try {
 		return await Promise.any(expectedRPIDs.map((expected) => {
 			return new Promise((resolve, reject) => {
@@ -109432,72 +109579,188 @@ async function matchExpectedRPID(rpIDHash, expectedRPIDs) {
 			});
 		}));
 	} catch (err) {
-		if (err.name === "AggregateError") throw new UnexpectedRPIDHash();
+		if (err.name === "AggregateError") throw new SimpleWebAuthnError({
+			message: "Unexpected RP ID hash",
+			code: "UNEXPECTED_RP_ID"
+		});
 		throw err;
 	}
 }
-var UnexpectedRPIDHash = class extends Error {
-	constructor() {
-		super("Unexpected RP ID hash");
-		this.name = "UnexpectedRPIDHash";
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/helpers/serviceStateTracker.js
+var SERVICE_STATE;
+(function(SERVICE_STATE) {
+	SERVICE_STATE["DISABLED"] = "DISABLED";
+	SERVICE_STATE["REFRESHING"] = "REFRESHING";
+	SERVICE_STATE["READY"] = "READY";
+})(SERVICE_STATE || (SERVICE_STATE = {}));
+var ServiceStateTracker = class {
+	constructor(name, logger) {
+		Object.defineProperty(this, "name", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: name
+		});
+		Object.defineProperty(this, "logger", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: logger
+		});
+		Object.defineProperty(this, "state", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: SERVICE_STATE.DISABLED
+		});
+	}
+	/**
+	* Get the current state
+	*/
+	get current() {
+		return this.state;
+	}
+	/**
+	* Set a new state and report it
+	*/
+	set(next) {
+		if (this.state === next) return;
+		this.state = next;
+		this.logger.debug(`${this.name} is ${SERVICE_STATE[this.state]}`);
+	}
+	/**
+	* A helper method to pause execution until the service is ready
+	*/
+	pauseUntilReady() {
+		if (this.state === SERVICE_STATE.READY) return Promise.resolve();
+		return new Promise((resolve, reject) => {
+			const totalTimeoutMS = 7e4;
+			const intervalMS = 100;
+			let iterations = totalTimeoutMS / intervalMS;
+			const intervalID = globalThis.setInterval(() => {
+				if (iterations < 1) {
+					clearInterval(intervalID);
+					reject(`State did not become ready in ${totalTimeoutMS / 1e3} seconds`);
+				} else if (this.state === SERVICE_STATE.READY) {
+					clearInterval(intervalID);
+					resolve();
+				}
+				iterations -= 1;
+			}, intervalMS);
+		});
 	}
 };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationFIDOU2F.js
 /**
-* Verify an attestation response with fmt 'fido-u2f'
+* An MDS-aware metadata cache that tracks MDS servers and the data downloaded from them. This
+* includes tracking when an MDS server needs to be refreshed, but does not actually perform the
+* refresh.
 */
-async function verifyAttestationFIDOU2F(options) {
-	const { attStmt, clientDataHash, rpIdHash, credentialID, credentialPublicKey, aaguid, rootCertificates } = options;
-	const signatureBase = concat([
-		Uint8Array.from([0]),
-		rpIdHash,
-		clientDataHash,
-		credentialID,
-		convertCOSEtoPKCS(credentialPublicKey)
-	]);
-	const sig = attStmt.get("sig");
-	const x5c = attStmt.get("x5c");
-	if (!x5c) throw new Error("No attestation certificate provided in attestation statement (FIDOU2F)");
-	if (!sig) throw new Error("No attestation signature provided in attestation statement (FIDOU2F)");
-	const aaguidToHex = Number.parseInt(toHex(aaguid), 16);
-	if (aaguidToHex !== 0) throw new Error(`AAGUID "${aaguidToHex}" was not expected value`);
-	try {
-		await validateCertificatePath(x5c.map(convertCertBufferToPEM), rootCertificates);
-	} catch (err) {
-		throw new Error(`${err.message} (FIDOU2F)`);
+var MDSCache = class {
+	constructor() {
+		Object.defineProperty(this, "serverCache", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: /* @__PURE__ */ new Map()
+		});
+		Object.defineProperty(this, "metadataCache", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: /* @__PURE__ */ new Map()
+		});
 	}
-	return verifySignature({
-		signature: sig,
-		data: signatureBase,
-		x509Certificate: x5c[0],
-		hashAlgorithm: COSEALG.ES256
-	});
-}
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/validateExtFIDOGenCEAAGUID.js
-/**
-* Attestation Certificate Extension OID: `id-fido-gen-ce-aaguid`
-*
-* Sourced from https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-key-attestation-v2.0-ps-20150904.html#verifying-an-attestation-statement
-*/
-const id_fido_gen_ce_aaguid = "1.3.6.1.4.1.45724.1.1.4";
-/**
-* Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
-* the attestation statement AAGUID.
-*/
-function validateExtFIDOGenCEAAGUID(certExtensions, aaguid) {
-	if (!certExtensions) return true;
-	const extFIDOGenCEAAGUID = certExtensions.find((ext) => ext.extnID === id_fido_gen_ce_aaguid);
-	if (!extFIDOGenCEAAGUID) return true;
-	const parsedExtFIDOGenCEAAGUID = import_cjs$4.AsnParser.parse(extFIDOGenCEAAGUID.extnValue, import_cjs$4.OctetString);
-	const extValue = new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);
-	if (!areEqual(aaguid, extValue)) {
-		const _debugExtHex = toHex(extValue);
-		const _debugAAGUIDHex = toHex(aaguid);
-		throw new Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`);
+	/**
+	* Set up a Metadata Service API for periodic refreshes
+	*/
+	registerMDSServer(url, no, nextUpdate) {
+		this.serverCache.set(url, {
+			url,
+			no,
+			nextUpdate
+		});
 	}
-	return true;
-}
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/helpers/logging.js
+	/**
+	* Add the provided metadata to the cache, keyed by its corresponding AAGUID
+	*/
+	cacheMetadata(aaguid, metadata, url) {
+		this.metadataCache.set(this.normalizeAAGUID(aaguid), {
+			data: metadata,
+			url
+		});
+	}
+	/**
+	* Retrieve cached metadata by AAGUID
+	*/
+	getMetadata(aaguid) {
+		if (!aaguid) return;
+		if (aaguid instanceof Uint8Array) aaguid = convertAAGUIDToString(aaguid);
+		return this.metadataCache.get(this.normalizeAAGUID(aaguid))?.data;
+	}
+	/**
+	* Return how many metadata entries have been cached
+	*/
+	get count() {
+		return this.metadataCache.size;
+	}
+	/**
+	* Clear out caches
+	*/
+	reset() {
+		this.serverCache = /* @__PURE__ */ new Map();
+		this.metadataCache = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Remove cached Metadata Service data for a specific API server. If the URL indicates data that
+	* should not be refreshed, then simply exit.
+	*/
+	clearMetadataByURL(url) {
+		if (url === "") return;
+		for (const [aaguid, cached] of this.metadataCache.entries()) if (cached.url === url) this.metadataCache.delete(this.normalizeAAGUID(aaguid));
+	}
+	/**
+	* Whether an MDS server has been registered for periodic refreshes
+	*/
+	mdsServerIsRegistered(url) {
+		return this.serverCache.has(url);
+	}
+	/**
+	* Set the MDS server's nextUpdate
+	*/
+	setMDSServerNextUpdate(url, newNextUpdate) {
+		const server = this.serverCache.get(url);
+		if (!server) throw new SimpleWebAuthnError({
+			message: `No MDS server has been registered for "${url}". Register it with registerMDSServer() first`,
+			code: "BAD_ARGUMENT"
+		});
+		server.nextUpdate = newNextUpdate;
+		this.serverCache.set(url, server);
+	}
+	/**
+	* Retrieve the version number of the MDS server's latest known data
+	*/
+	getMDSServerDataVersion(url) {
+		const server = this.serverCache.get(url);
+		if (!server) throw new SimpleWebAuthnError({
+			message: `No MDS server has been registered for "${url}". Register it with registerMDSServer() first`,
+			code: "BAD_ARGUMENT"
+		});
+		return server.no;
+	}
+	/**
+	* Return a list of MDS server URLs with nextUpdates earlier than the provided date
+	*/
+	getStaleMDSServerURLs(date) {
+		return this.serverCache.values().filter((mds) => mds.url !== "" && date > mds.nextUpdate).map((mds) => mds.url).toArray();
+	}
+	/**
+	* Ensure that AAGUIDs are all lowercase before using them as cache keys
+	*/
+	normalizeAAGUID(aaguid) {
+		return aaguid.toLowerCase();
+	}
+};
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/logging.js
 /**
 * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
 * of the `SimpleWebAuthnLogger` interface is specified.
@@ -109520,66 +109783,231 @@ function buildLoggerAllMethods(logger) {
 	if (logger.error) toReturn.error = logger.error;
 	return toReturn;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/services/metadataService.js
-/**
-* An instance of `CachedMDS` that will not trigger attempts to refresh the associated entry's blob
-*/
-const NonRefreshingMDS = {
-	url: "",
-	no: 0,
-	nextUpdate: /* @__PURE__ */ new Date(0)
-};
-const defaultURLMDS = "https://mds.fidoalliance.org/";
-var SERVICE_STATE;
-(function(SERVICE_STATE) {
-	SERVICE_STATE[SERVICE_STATE["DISABLED"] = 0] = "DISABLED";
-	SERVICE_STATE[SERVICE_STATE["REFRESHING"] = 1] = "REFRESHING";
-	SERVICE_STATE[SERVICE_STATE["READY"] = 2] = "READY";
-})(SERVICE_STATE || (SERVICE_STATE = {}));
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/helpers/getInitCacheMessage.js
 /**
-* An implementation of `MetadataService` that can download and parse BLOBs, and support on-demand
-* requesting and caching of individual metadata statements.
+* Generate a message detailing how many metadata entries were cached, and from which sources
 *
-* https://fidoalliance.org/metadata/
+* Examples:
+*
+* - "ConvenienceMetadataService cached 322 unique metadata entries from 1 local payload(s) and 1 convenience metadata server(s)"
+* - "ConvenienceMetadataService cached 322 unique metadata entries from 1 local payload(s)"
+* - "MetadataService cached 285 unique metadata entries from 1 convenience metadata server(s)"
+* - "MetadataService cached 0 unique metadata entries"
+*/
+function getInitCacheMessage(serviceName, cacheCount, numLocalFiles, numServers) {
+	let message = `${serviceName} cached ${cacheCount} unique entries`;
+	if (cacheCount) {
+		const formatter = new Intl.ListFormat("en", {
+			style: "long",
+			type: "conjunction"
+		});
+		const sources = [];
+		if (numLocalFiles) sources.push(`${numLocalFiles} local file(s)`);
+		if (numServers) sources.push(`${numServers} metadata server(s)`);
+		message = `${message} from ${formatter.format(sources)}`;
+	}
+	return message;
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/helpers/baseMDSService.js
+/**
+* Functionality shared by services that download, cache, and refresh metadata from FIDO
+* Alliance-style metadata servers (MDS and Convenience MDS.) Subclasses are responsible for
+* parsing and caching what a server returns.
 */
-var BaseMetadataService = class {
-	constructor() {
-		Object.defineProperty(this, "mdsCache", {
+var BaseMDSService = class {
+	/**
+	* @param serviceName Used in logs, e.g. `"MetadataService"`
+	*/
+	constructor(serviceName) {
+		Object.defineProperty(this, "serviceName", {
 			enumerable: true,
 			configurable: true,
 			writable: true,
-			value: {}
+			value: serviceName
 		});
-		Object.defineProperty(this, "statementCache", {
+		Object.defineProperty(this, "metadataCache", {
 			enumerable: true,
 			configurable: true,
 			writable: true,
-			value: {}
+			value: new MDSCache()
 		});
 		Object.defineProperty(this, "state", {
 			enumerable: true,
 			configurable: true,
 			writable: true,
-			value: SERVICE_STATE.DISABLED
+			value: void 0
 		});
-		Object.defineProperty(this, "verificationMode", {
+		Object.defineProperty(this, "logger", {
 			enumerable: true,
 			configurable: true,
 			writable: true,
-			value: "strict"
+			value: DefaultNoopLogger
 		});
-		Object.defineProperty(this, "logger", {
+		/** How many hours to wait to check a server again when it has nothing new to download */
+		Object.defineProperty(this, "defaultRefreshDelayHours", {
 			enumerable: true,
 			configurable: true,
 			writable: true,
-			value: DefaultNoopLogger
+			value: 24
+		});
+		/** How many hours to wait to retry a _failed_ attempt to refresh a server */
+		Object.defineProperty(this, "defaultRetryDelayHours", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: 3
+		});
+		/** Abort downloads that take longer than this many milliseconds. No limit if left `undefined` */
+		Object.defineProperty(this, "downloadTimeoutMS", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: 1e4
+		});
+		/**
+		* Refresh a single server, subscribing to the refresh already in flight if there is one.
+		* Failures are passed to `handleRefreshFailure()`.
+		*/
+		Object.defineProperty(this, "serverRefreshes", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: {}
 		});
+		this.state = new ServiceStateTracker(serviceName, this.logger);
 	}
-	async initialize(opts = {}) {
-		this.statementCache = {};
-		const { mdsServers = [defaultURLMDS], statements, verificationMode, logger = DefaultNoopLogger } = opts;
+	/**
+	* Reset the service and move it to the `REFRESHING` state. Call this at the start of
+	* `initialize()`.
+	*/
+	beginInitialize(logger = DefaultNoopLogger) {
+		this.metadataCache.reset();
+		this.serverRefreshes = {};
 		this.logger = buildLoggerAllMethods(logger);
-		this.setState(SERVICE_STATE.REFRESHING);
+		this.state = new ServiceStateTracker(this.serviceName, this.logger);
+		this.state.set(SERVICE_STATE.REFRESHING);
+	}
+	/**
+	* Download and cache from each server. A server is only registered for refreshes once data from
+	* it has been cached. One that can't be reached, or that doesn't respond with data, is skipped
+	* so it can't cause lookups of other metadata to fail.
+	*
+	* Returns the number of servers entries were cached from.
+	*/
+	async initializeServers(mdsServers) {
+		let numServers = 0;
+		for (const url of mdsServers ?? []) try {
+			const entriesAdded = await this.downloadAndCache(url, 0);
+			if (entriesAdded !== void 0) {
+				numServers += 1;
+				this.logger.debug(`Cached ${entriesAdded} metadata entries from "${url}"`);
+			}
+		} catch (err) {
+			this.logger.error(`Could not download data from "${url}":`, err);
+		}
+		return numServers;
+	}
+	/**
+	* Log how much was cached and report the service as ready. Call this at the end of
+	* `initialize()`.
+	*/
+	finishInitialize(numLocalFiles, numServers) {
+		const cacheMessage = getInitCacheMessage(this.serviceName, this.metadataCache.count, numLocalFiles, numServers);
+		this.logger.info(cacheMessage);
+		this.state.set(SERVICE_STATE.READY);
+	}
+	/**
+	* Request data from a server, with a query param that can short-circuit the download if the
+	* latest version is already cached. `no` is the serial number of the last data cached from this
+	* server.
+	*
+	* Returns `undefined` if the server responded with anything other than data, in which case the
+	* next refresh will have been delayed.
+	*
+	* See https://fidoalliance.org/specs/mds/fido-metadata-service-v3.1-ps-20250521.html#sctn-mds-blob-proc-rules
+	*/
+	async fetchFromServer(url, no) {
+		const _url = new URL(url);
+		_url.searchParams.set("localCopySerial", String(no));
+		const resp = await fetch(_url.toString(), { signal: AbortSignal.timeout(this.downloadTimeoutMS) });
+		if (resp.status === 304) {
+			await resp.body?.cancel();
+			this.logger.info(`The MDS server at "${_url.toString()}" reported nothing new to download (HTTP 304)`);
+			this.delayNextRefresh(url, this.defaultRefreshDelayHours);
+			return;
+		}
+		if (resp.status === 429) {
+			await resp.body?.cancel();
+			this.logger.warn(`The MDS server at "${_url.toString()}" rate-limited this request (HTTP 429)`);
+			this.delayNextRefresh(url, this.defaultRetryDelayHours);
+			return;
+		}
+		if (!resp.ok) {
+			await resp.body?.cancel();
+			this.logger.warn(`The MDS server at "${_url.toString()}" reported an unsuccessful request (HTTP ${resp.status})`);
+			this.delayNextRefresh(url, this.defaultRetryDelayHours);
+			return;
+		}
+		return resp;
+	}
+	/**
+	* Refresh every server whose `nextUpdate` has passed
+	*/
+	async refreshStaleServers() {
+		const now = /* @__PURE__ */ new Date();
+		const staleURLs = this.metadataCache.getStaleMDSServerURLs(now);
+		await Promise.all(staleURLs.map((url) => this.refreshServer(url)));
+	}
+	refreshServer(url) {
+		const inFlight = this.serverRefreshes[url];
+		if (inFlight) return inFlight;
+		this.state.set(SERVICE_STATE.REFRESHING);
+		const refresh = (async () => {
+			try {
+				const mdsNo = this.metadataCache.getMDSServerDataVersion(url);
+				await this.downloadAndCache(url, mdsNo);
+			} catch (err) {
+				this.logger.error(`Could not download data from "${url}":`, err);
+				this.handleRefreshFailure(url, err);
+			} finally {
+				delete this.serverRefreshes[url];
+				if (Object.keys(this.serverRefreshes).length === 0) this.state.set(SERVICE_STATE.READY);
+			}
+		})();
+		this.serverRefreshes[url] = refresh;
+		return refresh;
+	}
+	/**
+	* Delay the next refresh attempt of this server by the specified number of hours
+	*/
+	delayNextRefresh(url, numHours) {
+		if (!this.metadataCache.mdsServerIsRegistered(url)) return;
+		this.logger.debug(`Delaying next refresh of "${url}" by ${numHours} hours`);
+		const numHoursMS = 36e5 * numHours;
+		this.metadataCache.setMDSServerNextUpdate(url, new Date(Date.now() + numHoursMS));
+	}
+};
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/metadataService.js
+const defaultURLMDS = "https://mds.fidoalliance.org/";
+/**
+* An implementation of `MetadataService` that can download and parse BLOBs, and support on-demand
+* requesting and caching of individual metadata statements.
+*
+* https://fidoalliance.org/metadata/
+*/
+var BaseMetadataService = class extends BaseMDSService {
+	constructor() {
+		super("MetadataService");
+		Object.defineProperty(this, "verificationMode", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: "strict"
+		});
+	}
+	async initialize(opts = {}) {
+		const { mdsServers = [defaultURLMDS], statements, verificationMode, logger } = opts;
+		this.beginInitialize(logger);
 		/**
 		* If metadata statements are provided, load them into the cache first. These statements will
 		* not be refreshed when a stale one is detected.
@@ -109587,139 +110015,240 @@ var BaseMetadataService = class {
 		if (statements?.length) {
 			let statementsAdded = 0;
 			statements.forEach((statement) => {
-				if (statement.aaguid) {
-					this.statementCache[statement.aaguid] = {
-						entry: {
-							metadataStatement: statement,
-							statusReports: [],
-							timeOfLastStatusChange: "1970-01-01"
-						},
-						url: NonRefreshingMDS.url
-					};
-					statementsAdded += 1;
-				}
+				statementsAdded += this.cacheMetadataBlobEntry("", {
+					aaguid: statement.aaguid,
+					metadataStatement: statement,
+					statusReports: [],
+					timeOfLastStatusChange: "1970-01-01"
+				});
 			});
-			this.logger.info(`Cached ${statementsAdded} local statements`);
+			this.logger.info(`Cached ${statementsAdded} total local metadata statements`);
 		}
 		/**
 		* If MDS servers are provided, then download blobs from them, verify them, and then add their
 		* entries to the cache. Blobs loaded in this way will be refreshed when a stale entry within is
 		* detected.
 		*/
-		if (mdsServers?.length) {
-			const currentCacheCount = Object.keys(this.statementCache).length;
-			let numServers = mdsServers.length;
-			for (const url of mdsServers) try {
-				const cachedMDS = {
-					url,
-					no: 0,
-					nextUpdate: /* @__PURE__ */ new Date(0)
-				};
-				const blob = await this.downloadBlob(cachedMDS);
-				await this.verifyBlob(blob, cachedMDS);
-			} catch (err) {
-				this.logger.error(`Could not download BLOB from ${url}:`, err);
-				numServers -= 1;
-			}
-			const cacheDiff = Object.keys(this.statementCache).length - currentCacheCount;
-			this.logger.info(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`);
-		}
-		if (verificationMode) this.verificationMode = verificationMode;
-		this.setState(SERVICE_STATE.READY);
+		const numServers = await this.initializeServers(mdsServers);
+		this.verificationMode = verificationMode ?? "strict";
+		this.finishInitialize(statements?.length, numServers);
 	}
 	async getStatement(aaguid) {
-		if (this.state === SERVICE_STATE.DISABLED) return;
+		if (this.state.current === SERVICE_STATE.DISABLED) return;
 		if (!aaguid) return;
 		if (aaguid instanceof Uint8Array) aaguid = convertAAGUIDToString(aaguid);
-		await this.pauseUntilReady();
-		const cachedStatement = this.statementCache[aaguid];
-		if (!cachedStatement) {
+		await this.state.pauseUntilReady();
+		await this.refreshStaleServers();
+		const entry = this.metadataCache.getMetadata(aaguid);
+		if (!entry) {
 			if (this.verificationMode === "strict") throw new Error(`No metadata statement found for aaguid "${aaguid}"`);
 			return;
 		}
-		if (cachedStatement.url) {
-			const mds = this.mdsCache[cachedStatement.url];
-			if (/* @__PURE__ */ new Date() > mds.nextUpdate) try {
-				this.setState(SERVICE_STATE.REFRESHING);
-				const blob = await this.downloadBlob(mds);
-				await this.verifyBlob(blob, mds);
-			} finally {
-				this.setState(SERVICE_STATE.READY);
-			}
-		}
-		const { entry } = cachedStatement;
 		for (const report of entry.statusReports) {
 			const { status } = report;
 			if (status === "USER_VERIFICATION_BYPASS" || status === "ATTESTATION_KEY_COMPROMISE" || status === "USER_KEY_REMOTE_COMPROMISE" || status === "USER_KEY_PHYSICAL_COMPROMISE") throw new Error(`Detected compromised aaguid "${aaguid}"`);
 		}
 		return entry.metadataStatement;
 	}
+	async getProviderMetadata(aaguid) {
+		/**
+		* This is a load-bearing check: without it the `this.verificationMode === 'strict'` check in
+		* `getStatement()` will raise an error on this method when there's no need to do so because
+		* this method's returning `undefined` does not impact the security posture of the RP.
+		*/
+		if (!aaguid) return;
+		const metadataStatement = await this.getStatement(aaguid);
+		if (!metadataStatement) return;
+		return {
+			friendlyNames: metadataStatement.friendlyNames,
+			icon: metadataStatement.icon,
+			iconDark: metadataStatement.iconDark,
+			providerLogoDark: metadataStatement.providerLogoDark,
+			providerLogoLight: metadataStatement.providerLogoLight
+		};
+	}
+	/**
+	* Download the latest BLOB from MDS, verify it, and cache its entries
+	*/
+	async downloadAndCache(url, no) {
+		const resp = await this.fetchFromServer(url, no);
+		if (!resp) return;
+		const blob = await resp.text();
+		return this.verifyBlob(blob, url, no);
+	}
 	/**
-	* Download and process the latest BLOB from MDS
+	* Refresh failures are rethrown so that lookups fail closed: until the refresh succeeds the
+	* server stays stale, every lookup tries again, and none of them are answered with statements
+	* from the BLOB that was previously cached.
 	*/
-	async downloadBlob(cachedMDS) {
-		const { url } = cachedMDS;
-		return await (await fetch(url)).text();
+	handleRefreshFailure(_url, err) {
+		throw err;
 	}
 	/**
-	* Verify and process the MDS metadata blob
+	* Verify and process the MDS metadata blob. Caches metadata and sets up refreshing when blobs
+	* grow stale. `no` is the serial number of the last BLOB cached from this server.
+	*
+	* Returns the number of FIDO2 metadata statements that were cached.
 	*/
-	async verifyBlob(blob, cachedMDS) {
-		const { url, no } = cachedMDS;
+	async verifyBlob(blob, url, no) {
 		const { payload, parsedNextUpdate } = await verifyMDSBlob(blob);
 		if (payload.no <= no) throw new Error(`Latest BLOB no. ${payload.no} is not greater than previous no. ${no}`);
-		for (const entry of payload.entries) if (entry.aaguid) this.statementCache[entry.aaguid] = {
-			entry,
-			url
-		};
-		if (url) this.mdsCache[url] = {
-			...cachedMDS,
-			no: payload.no,
-			nextUpdate: parsedNextUpdate
-		};
+		this.metadataCache.clearMetadataByURL(url);
+		let totalEntries = 0;
+		for (const entry of payload.entries) totalEntries += this.cacheMetadataBlobEntry(url, entry);
+		if (url !== "") this.metadataCache.registerMDSServer(url, payload.no, parsedNextUpdate);
 		else if (parsedNextUpdate < /* @__PURE__ */ new Date()) this.logger.warn(`⚠️ This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`);
+		return totalEntries;
 	}
 	/**
-	* A helper method to pause execution until the service is ready
+	* A central place to contain logic and side effects of caching a BLOB entry. Only caches FIDO2
+	* statements (i.e. ones with `aaguid` as UAF authenticators won't have one.) Returns `1` if the
+	* statement was cached, or `0` if it wasn't (so you can `count += cacheMetadataBlobEntry(...)`)
 	*/
-	pauseUntilReady() {
-		if (this.state === SERVICE_STATE.READY) return new Promise((resolve) => {
-			resolve();
-		});
-		return new Promise((resolve, reject) => {
-			const totalTimeoutMS = 7e4;
-			const intervalMS = 100;
-			let iterations = totalTimeoutMS / intervalMS;
-			const intervalID = globalThis.setInterval(() => {
-				if (iterations < 1) {
-					clearInterval(intervalID);
-					reject(`State did not become ready in ${totalTimeoutMS / 1e3} seconds`);
-				} else if (this.state === SERVICE_STATE.READY) {
-					clearInterval(intervalID);
-					resolve();
-				}
-				iterations -= 1;
-			}, intervalMS);
+	cacheMetadataBlobEntry(url, entry) {
+		if (!entry.aaguid) return 0;
+		this.metadataCache.cacheMetadata(entry.aaguid, entry, url);
+		return 1;
+	}
+};
+/**
+* A basic service for coordinating interactions with the FIDO Metadata Service. This includes BLOB
+* download and parsing, and on-demand requesting and caching of individual metadata statements.
+*
+* https://fidoalliance.org/metadata/
+*/
+const MetadataService = new BaseMetadataService();
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/services/convenienceMetadataService.js
+const defaultURLConvenienceMDS = "https://c-mds.fidoalliance.org/";
+var BaseConvenienceMetadataService = class extends BaseMDSService {
+	constructor() {
+		super("ConvenienceMetadataService");
+	}
+	async initialize(opts = {}) {
+		const { mdsServers = [defaultURLConvenienceMDS], payloads, logger } = opts;
+		this.beginInitialize(logger);
+		/**
+		* If passkey provider metadata is provided, load them into the cache first.
+		*/
+		if (payloads?.length) {
+			let entriesAdded = 0;
+			payloads.forEach((payload) => {
+				entriesAdded += this.cacheConvenienceMDS("", payload);
+			});
+			this.logger.debug(`Cached ${entriesAdded} total local metadata entries`);
+		}
+		/**
+		* If Convenience MDS server URLs are provided, then download and cache the current collection
+		* of metadata from them.
+		*/
+		const numServers = await this.initializeServers(mdsServers);
+		this.finishInitialize(payloads?.length, numServers);
+	}
+	/**
+	* Download the convenience metadata, which is surprisingly just a JSON document, and cache it
+	*/
+	async downloadAndCache(url, no) {
+		const resp = await this.fetchFromServer(url, no);
+		if (!resp) return;
+		const payload = await resp.json();
+		return this.cacheConvenienceMDS(url, payload);
+	}
+	/**
+	* Refresh failures cause that server's refresh to be re-attempted at a later date
+	*/
+	handleRefreshFailure(url) {
+		this.delayNextRefresh(url, this.defaultRetryDelayHours);
+	}
+	/**
+	* Cache the AAGUID-keyed entries in a Convenience MDS payload. Returns the number of entries
+	* cached (so you can `count += cacheConvenienceMDS(...)`)
+	*/
+	cacheConvenienceMDS(url, payload) {
+		let entriesAdded = 0;
+		this.metadataCache.clearMetadataByURL(url);
+		Object.keys(payload).forEach((aaguid) => {
+			if (aaguid === "no") return;
+			this.metadataCache.cacheMetadata(aaguid, payload[aaguid], url);
+			entriesAdded += 1;
 		});
+		this.metadataCache.registerMDSServer(url, payload.no, new Date(Date.now() + 36e5 * this.defaultRefreshDelayHours));
+		return entriesAdded;
 	}
 	/**
-	* Report service status on change
+	* Get a collection of metadata about a credential manager, including localized name(s) and
+	* light and dark iconography when available. Returns `undefined` if no such metadata has been
+	* registered with a Convenience MDS.
 	*/
-	setState(newState) {
-		this.state = newState;
-		if (newState === SERVICE_STATE.DISABLED) this.logger.debug("MetadataService is DISABLED");
-		else if (newState === SERVICE_STATE.REFRESHING) this.logger.debug("MetadataService is REFRESHING");
-		else if (newState === SERVICE_STATE.READY) this.logger.debug("MetadataService is READY");
+	async getProviderMetadata(aaguid) {
+		if (this.state.current === SERVICE_STATE.DISABLED) return;
+		await this.state.pauseUntilReady();
+		await this.refreshStaleServers();
+		return this.metadataCache.getMetadata(aaguid);
 	}
 };
 /**
-* A basic service for coordinating interactions with the FIDO Metadata Service. This includes BLOB
-* download and parsing, and on-demand requesting and caching of individual metadata statements.
+* A basic service for coordinating interactions with the FIDO Convenience Metadata Service. This
+* includes metadata download and parsing, and on-demand requesting and caching of provider details.
 *
 * https://fidoalliance.org/metadata/
 */
-const MetadataService = new BaseMetadataService();
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/metadata/verifyAttestationWithMetadata.js
+const ConvenienceMetadataService = new BaseConvenienceMetadataService();
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationFIDOU2F.js
+/**
+* Verify an attestation response with fmt 'fido-u2f'
+*/
+async function verifyAttestationFIDOU2F(options) {
+	const { attStmt, clientDataHash, rpIdHash, credentialID, credentialPublicKey, aaguid, rootCertificates } = options;
+	const signatureBase = concat([
+		Uint8Array.from([0]),
+		rpIdHash,
+		clientDataHash,
+		credentialID,
+		convertCOSEtoPKCS(credentialPublicKey)
+	]);
+	const sig = attStmt.get("sig");
+	const x5c = attStmt.get("x5c");
+	if (!x5c) throw new Error("No attestation certificate provided in attestation statement (FIDOU2F)");
+	if (!sig) throw new Error("No attestation signature provided in attestation statement (FIDOU2F)");
+	const aaguidToHex = Number.parseInt(toHex(aaguid), 16);
+	if (aaguidToHex !== 0) throw new Error(`AAGUID "${aaguidToHex}" was not expected value`);
+	try {
+		await validateCertificatePath(x5c.map(convertCertBufferToPEM), rootCertificates);
+	} catch (err) {
+		throw new Error(`${err.message} (FIDOU2F)`);
+	}
+	return verifySignature({
+		signature: sig,
+		data: signatureBase,
+		x509Certificate: x5c[0],
+		hashAlgorithm: COSEALG.ES256
+	});
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/validateExtFIDOGenCEAAGUID.js
+/**
+* Attestation Certificate Extension OID: `id-fido-gen-ce-aaguid`
+*
+* Sourced from https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-key-attestation-v2.0-ps-20150904.html#verifying-an-attestation-statement
+*/
+const id_fido_gen_ce_aaguid = "1.3.6.1.4.1.45724.1.1.4";
+/**
+* Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
+* the attestation statement AAGUID.
+*/
+function validateExtFIDOGenCEAAGUID(certExtensions, aaguid) {
+	if (!certExtensions) return true;
+	const extFIDOGenCEAAGUID = certExtensions.find((ext) => ext.extnID === id_fido_gen_ce_aaguid);
+	if (!extFIDOGenCEAAGUID) return true;
+	const parsedExtFIDOGenCEAAGUID = import_cjs$4.AsnParser.parse(extFIDOGenCEAAGUID.extnValue, import_cjs$4.OctetString);
+	const extValue = new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);
+	if (!areEqual(aaguid, extValue)) {
+		const _debugExtHex = toHex(extValue);
+		const _debugAAGUIDHex = toHex(aaguid);
+		throw new Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`);
+	}
+	return true;
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/metadata/verifyAttestationWithMetadata.js
 /**
 * Match properties of the authenticator's attestation statement against expected values as
 * registered with the FIDO Alliance Metadata Service
@@ -109880,7 +110409,7 @@ function stringifyCOSEInfo(info) {
 	else toReturn = `{ kty: ${kty}, alg: ${alg} }`;
 	return toReturn;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationPacked.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationPacked.js
 /**
 * Verify an attestation response with fmt 'packed'
 */
@@ -109945,7 +110474,7 @@ async function verifyAttestationPacked(options) {
 	});
 	return verified;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidSafetyNet.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidSafetyNet.js
 /**
 * Verify an attestation response with fmt 'android-safetynet'
 */
@@ -110014,7 +110543,7 @@ async function verifyAttestationAndroidSafetyNet(options) {
 		hashAlgorithm: alg
 	});
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/constants.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/constants.js
 /**
 * A whole lotta domain knowledge is captured here, with hazy connections to source
 * documents. Good places to start searching for more info on these values are the
@@ -110233,13 +110762,13 @@ const TPM_MANUFACTURERS = {
 * Match TPM public area curve ID's to `crv` numbers used in COSE public keys
 */
 const TPM_ECC_CURVE_COSE_CRV_MAP = {
-	TPM_ECC_NIST_P256: 1,
-	TPM_ECC_NIST_P384: 2,
-	TPM_ECC_NIST_P521: 3,
-	TPM_ECC_BN_P256: 1,
-	TPM_ECC_SM2_P256: 1
+	TPM_ECC_NIST_P256: COSECRV.P256,
+	TPM_ECC_NIST_P384: COSECRV.P384,
+	TPM_ECC_NIST_P521: COSECRV.P521,
+	TPM_ECC_BN_P256: COSECRV.P256,
+	TPM_ECC_SM2_P256: COSECRV.P256
 };
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/parseCertInfo.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/parseCertInfo.js
 /**
 * Cut up a TPM attestation's certInfo into intelligible chunks
 */
@@ -110291,7 +110820,7 @@ function parseCertInfo(certInfo) {
 		}
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/parsePubArea.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/parsePubArea.js
 /**
 * Break apart a TPM attestation's pubArea buffer
 *
@@ -110352,6 +110881,27 @@ function parsePubArea(pubArea) {
 		pointer += 2;
 		const scheme = TPM_ALG[dataView.getUint16(pointer)];
 		pointer += 2;
+		/**
+		* In TPM 2.0, a non-TPM_ALG_NULL scheme is followed by alg-specific "details" bytes.
+		* For TPM_ALG_ECC this is defined as TPMT_ECC_SCHEME, which is the
+		* scheme (TPMI_ALG_ECC_SCHEME) followed by details (TPMU_ECC_SCHEME).
+		*
+		* See 11.2.5.7 TPMT_ECC_SCHEME here:
+		* https://medias.cdn.trustedcomputinggroup.org/production/Trusted_Platform_Module_2_0_Library_Part_2_Structures_Version_185_pub_c0a962a931.pdf >
+		*/
+		const details = {};
+		if (scheme === "TPM_ALG_NULL") {} else if (scheme === "TPM_ALG_ECDSA") {
+			details.hashAlg = TPM_ALG[dataView.getUint16(pointer)];
+			pointer += 2;
+		} else if (scheme === "TPM_ALG_ECSCHNORR") {
+			details.hashAlg = TPM_ALG[dataView.getUint16(pointer)];
+			pointer += 2;
+		} else if (scheme === "TPM_ALG_ECDAA") {
+			details.hashAlg = TPM_ALG[dataView.getUint16(pointer)];
+			pointer += 2;
+			details.count = dataView.getUint16(pointer);
+			pointer += 2;
+		}
 		const curveID = TPM_ECC_CURVE[dataView.getUint16(pointer)];
 		pointer += 2;
 		const kdf = TPM_ALG[dataView.getUint16(pointer)];
@@ -110359,6 +110909,7 @@ function parsePubArea(pubArea) {
 		parameters.ecc = {
 			symmetric,
 			scheme,
+			details,
 			curveID,
 			kdf
 		};
@@ -110382,12 +110933,12 @@ function parsePubArea(pubArea) {
 		unique
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/isValidTPMManufacturerID.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/isValidTPMManufacturerID.js
 function getTPMManufacturerInfo(id) {
 	const _normalized = `id:${id.substring(3).toUpperCase()}`;
 	return TPM_MANUFACTURERS[_normalized];
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/verifyAttestationTPM.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/verifyAttestationTPM.js
 async function verifyAttestationTPM(options) {
 	const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash, rootCertificates } = options;
 	const ver = attStmt.get("ver");
@@ -110422,17 +110973,19 @@ async function verifyAttestationTPM(options) {
 		if (pubAreaExponent !== eSum) throw new Error(`Unexpected public key exp ${eSum}, expected ${pubAreaExponent} (TPM|RSA)`);
 	} else if (pubType === "TPM_ALG_ECC") {
 		if (!isCOSEPublicKeyEC2(cosePublicKey)) throw new Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);
-		const crv = cosePublicKey.get(COSEKEYS.crv);
-		const x = cosePublicKey.get(COSEKEYS.x);
-		const y = cosePublicKey.get(COSEKEYS.y);
-		if (!crv) throw new Error("COSE public key missing crv (TPM|ECC)");
-		if (!x) throw new Error("COSE public key missing x (TPM|ECC)");
-		if (!y) throw new Error("COSE public key missing y (TPM|ECC)");
-		if (!areEqual(unique, concat([x, y]))) throw new Error("PubArea unique is not same as public key x and y (TPM|ECC)");
+		const pubKeyAlg = cosePublicKey.get(COSEKEYS.alg);
+		const pubKeyCrv = cosePublicKey.get(COSEKEYS.crv);
+		const pubKeyX = cosePublicKey.get(COSEKEYS.x);
+		const pubKeyY = cosePublicKey.get(COSEKEYS.y);
+		if (!pubKeyAlg) throw new Error("COSE public key missing crv (TPM|ECC)");
+		if (!pubKeyCrv) throw new Error("COSE public key missing crv (TPM|ECC)");
+		if (!pubKeyX) throw new Error("COSE public key missing x (TPM|ECC)");
+		if (!pubKeyY) throw new Error("COSE public key missing y (TPM|ECC)");
+		if (!areEqual(unique, concat([pubKeyX, pubKeyY]))) throw new Error("PubArea unique is not same as public key x and y (TPM|ECC)");
 		if (!parameters.ecc) throw new Error(`Parsed pubArea type is ECC, but missing parameters.ecc (TPM|ECC)`);
 		const pubAreaCurveID = parameters.ecc.curveID;
 		const pubAreaCurveIDMapToCOSECRV = TPM_ECC_CURVE_COSE_CRV_MAP[pubAreaCurveID];
-		if (pubAreaCurveIDMapToCOSECRV !== crv) throw new Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${crv}" (TPM|ECC)`);
+		if (pubAreaCurveIDMapToCOSECRV !== pubKeyCrv) throw new Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${pubKeyCrv}" (TPM|ECC)`);
 	} else throw new Error(`Unsupported pubArea.type "${pubType}"`);
 	const { magic, type: certType, attested, extraData } = parseCertInfo(certInfo);
 	if (magic !== 4283712327) throw new Error(`Unexpected magic value "${magic}", expected "0xff544347" (TPM)`);
@@ -111068,7 +111621,7 @@ var require_attestation = /* @__PURE__ */ __commonJSMin(((exports) => {
 		repeated: "set"
 	})], AttestationApplicationId.prototype, "signatureDigests", void 0);
 }));
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidKey.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidKey.js
 var import_cjs = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	const tslib_1 = (init_tslib_es6$1(), __toCommonJS(tslib_es6_exports$1));
@@ -111110,7 +111663,7 @@ async function verifyAttestationAndroidKey(options) {
 	* (i.e. These shouldn't contain the [600] tag)
 	*/
 	if (teeEnforced.allApplications !== void 0) throw new Error("teeEnforced contained \"allApplications [600]\" tag (Android Key)");
-	if (softwareEnforced.allApplications !== void 0) throw new Error("teeEnforced contained \"allApplications [600]\" tag (Android Key)");
+	if (softwareEnforced.allApplications !== void 0) throw new Error("softwareEnforced contained \"allApplications [600]\" tag (Android Key)");
 	const statement = await MetadataService.getStatement(aaguid);
 	if (statement) try {
 		await verifyAttestationWithMetadata({
@@ -111125,22 +111678,30 @@ async function verifyAttestationAndroidKey(options) {
 	}
 	else {
 		/**
-		* Verify that x5c contains a full certificate path.
+		* Fail closed if for some reason no root certificates were registered with SettingsService
+		* for this attestation format. Android Key attestation statements are a bit unique in that they
+		* contain a full certificate chain, which an attacker could abuse to perform arbitrary network
+		* requests within the RP's boundary if we simply validated x5c like other attestation formats.
 		*/
+		if (rootCertificates.length === 0) throw new Error("No root certificates were set with SettingsService for \"android-key\" attestation (Android Key)");
 		const x5cNoRootPEM = x5c.slice(0, -1).map(convertCertBufferToPEM);
 		const x5cRootPEM = x5c.slice(-1).map(convertCertBufferToPEM);
+		/**
+		* Make sure the final cert in x5c is one of the Google Hardware Attestation Root certificates
+		* before we attempt to validate the certificate chain.
+		*
+		* https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate
+		*/
+		if (rootCertificates.indexOf(x5cRootPEM[0]) < 0) throw new Error("x5c root certificate was not a known root certificate (Android Key)");
+		/**
+		* Verify that x5c contains a full certificate path.
+		*/
 		try {
 			await validateCertificatePath(x5cNoRootPEM, x5cRootPEM);
 		} catch (err) {
 			const _err = err;
 			throw new Error(`${_err.message} (Android Key)`, { cause: _err });
 		}
-		/**
-		* Make sure the root certificate is one of the Google Hardware Attestation Root certificates
-		*
-		* https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate
-		*/
-		if (rootCertificates.length > 0 && rootCertificates.indexOf(x5cRootPEM[0]) < 0) throw new Error("x5c root certificate was not a known root certificate (Android Key)");
 	}
 	return verifySignature({
 		signature: sig,
@@ -111149,7 +111710,7 @@ async function verifyAttestationAndroidKey(options) {
 		hashAlgorithm: alg
 	});
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationApple.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationApple.js
 async function verifyAttestationApple(options) {
 	const { attStmt, authData, clientDataHash, credentialPublicKey, rootCertificates } = options;
 	const x5c = attStmt.get("x5c");
@@ -111170,7 +111731,42 @@ async function verifyAttestationApple(options) {
 	if (!areEqual(convertCOSEtoPKCS(credentialPublicKey), new Uint8Array(subjectPublicKeyInfo.subjectPublicKey))) throw new Error("Credential public key does not equal credCert public key (Apple)");
 	return true;
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/assertValidExpectedOrigin.js
+/**
+* Check the origin to make sure it's valid to compare against what's reported in a WebAuthn
+* response.
+*
+* Invalid origins will raise a `SimpleWebAuthnError` with `code: 'BAD_ARGUMENT'`
+*/
+function assertValidExpectedOrigin(origin) {
+	if (!origin.startsWith("https://")) return;
+	if (origin.endsWith("/")) throw new SimpleWebAuthnError({
+		message: `"${origin}" is not a valid expected origin. Remove the trailing "/" and try again`,
+		code: "BAD_ARGUMENT"
+	});
+	const asciiOrigin = new URL(origin).origin;
+	if (asciiOrigin !== origin) throw new SimpleWebAuthnError({
+		message: `"${origin}" is not a valid expected origin. Replace it with its ASCII punycode representation "${asciiOrigin}" and try again`,
+		code: "BAD_ARGUMENT"
+	});
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/helpers/matchExpectedOrigin.js
+/**
+* Check that the origin reported in a WebAuthn response is an expected one.
+*
+* Raises a `SimpleWebAuthnError` if not match is found.
+*/
+function matchExpectedOrigin(origin, expectedOrigin) {
+	let _expectedOrigins = [];
+	if (typeof expectedOrigin === "string") _expectedOrigins = [expectedOrigin];
+	else _expectedOrigins = expectedOrigin;
+	for (const _origin of _expectedOrigins) assertValidExpectedOrigin(_origin);
+	if (!_expectedOrigins.includes(origin)) throw new SimpleWebAuthnError({
+		message: `Unexpected response origin "${origin}", expected one of: ${_expectedOrigins.join(", ")}`,
+		code: "UNEXPECTED_ORIGIN"
+	});
+}
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
 /**
 * Verify that the user has legitimately completed the registration process
 *
@@ -111205,9 +111801,7 @@ async function verifyRegistrationResponse(options) {
 	if (typeof expectedChallenge === "function") {
 		if (!await expectedChallenge(challenge)) throw new Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`);
 	} else if (challenge !== expectedChallenge) throw new Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);
-	if (Array.isArray(expectedOrigin)) {
-		if (!expectedOrigin.includes(origin)) throw new Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`);
-	} else if (origin !== expectedOrigin) throw new Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);
+	matchExpectedOrigin(origin, expectedOrigin);
 	if (tokenBinding) {
 		if (typeof tokenBinding !== "object") throw new Error(`Unexpected value for TokenBinding "${tokenBinding}"`);
 		if ([
@@ -111277,11 +111871,13 @@ async function verifyRegistrationResponse(options) {
 	} else throw new Error(`Unsupported Attestation Format: ${fmt}`);
 	if (!verified) return { verified: false };
 	const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
+	const formattedAAGUID = convertAAGUIDToString(aaguid);
 	return {
 		verified: true,
 		registrationInfo: {
 			fmt,
-			aaguid: convertAAGUIDToString(aaguid),
+			aaguid: formattedAAGUID,
+			passkeyProviderMetadata: await MetadataService.getProviderMetadata(formattedAAGUID) ?? await ConvenienceMetadataService.getProviderMetadata(formattedAAGUID),
 			credentialType,
 			credential: {
 				id: fromBuffer(credentialID),
@@ -111299,7 +111895,7 @@ async function verifyRegistrationResponse(options) {
 		}
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/authentication/generateAuthenticationOptions.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/authentication/generateAuthenticationOptions.js
 /**
 * Prepare a value to pass into navigator.credentials.get(...) for authenticator authentication
 *
@@ -111335,7 +111931,7 @@ async function generateAuthenticationOptions(options) {
 		extensions
 	};
 }
-// ../../node_modules/.pnpm/@simplewebauthn+server@14.0.3/node_modules/@simplewebauthn/server/esm/authentication/verifyAuthenticationResponse.js
+// ../../node_modules/.pnpm/@simplewebauthn+server@14.1.0/node_modules/@simplewebauthn/server/esm/authentication/verifyAuthenticationResponse.js
 /**
 * Verify that the user has legitimately completed the authentication process
 *
@@ -111399,12 +111995,7 @@ async function verifyAuthenticationResponse(options) {
 	* See https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin.
 	*/
 	throw new Error(`Unexpected top origin of "${topOrigin}" within a non-cross-origin authentication response. This error should be reported to the browser vendor as a WebAuthn specification violation with a link to https://w3c.github.io/webauthn/#dom-collectedclientdata-toporigin`);
-	if (Array.isArray(expectedOrigin)) {
-		if (!expectedOrigin.includes(origin)) {
-			const joinedExpectedOrigin = expectedOrigin.join(", ");
-			throw new Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`);
-		}
-	} else if (origin !== expectedOrigin) throw new Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);
+	matchExpectedOrigin(origin, expectedOrigin);
 	if (!isBase64URL(assertionResponse.authenticatorData)) throw new Error("Credential response authenticatorData was not a base64url string");
 	if (!isBase64URL(assertionResponse.signature)) throw new Error("Credential response signature was not a base64url string");
 	if (assertionResponse.userHandle && typeof assertionResponse.userHandle !== "string") throw new Error("Credential response userHandle was not a string");