surrge 0.11.3 → 0.11.4

package/dist/auth/config.d.ts

@@ -1,6 +1,4 @@
 export declare const challenges: Map<string, string>;
 export declare const rpName: string;
-export declare const rpID: string;
-export declare const origin: string;
 export declare const secret: string;
 //# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,UAAU,qBAA4B,CAAC;AAGpD,eAAO,MAAM,MAAM,EAAE,MAAiB,CAAC;AACvC,eAAO,MAAM,IAAI,EAAE,MAAgD,CAAC;AACpE,eAAO,MAAM,MAAM,EAAE,MACiC,CAAC;AAGvD,eAAO,MAAM,MAAM,EAAE,MAAkD,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,UAAU,qBAA4B,CAAC;AAGpD,eAAO,MAAM,MAAM,EAAE,MAAiB,CAAC;AAGvC,eAAO,MAAM,MAAM,EAAE,MAAkD,CAAC"}

package/dist/auth/passkey.d.ts

@@ -8,8 +8,8 @@ export type Registration = {
 export type Authentication = {
     counter: number;
 };
-export declare const challenge: (username: string) => Promise<Awaited<ReturnType<typeof generateRegistrationOptions>>>;
-export declare const register: (_username: string, response: VerifyRegistrationResponseOpts["response"], expectedChallenge: string) => Promise<Registration>;
-export declare const discover: () => Promise<Awaited<ReturnType<typeof generateAuthenticationOptions>>>;
-export declare const authenticate: (user: User.Record, response: VerifyAuthenticationResponseOpts["response"], expectedChallenge: string) => Promise<Authentication>;
+export declare const challenge: (username: string, rpID: string) => Promise<Awaited<ReturnType<typeof generateRegistrationOptions>>>;
+export declare const register: (_username: string, response: VerifyRegistrationResponseOpts["response"], expectedChallenge: string, expectedOrigin: string, expectedRPID: string) => Promise<Registration>;
+export declare const discover: (rpID: string) => Promise<Awaited<ReturnType<typeof generateAuthenticationOptions>>>;
+export declare const authenticate: (user: User.Record, response: VerifyAuthenticationResponseOpts["response"], expectedChallenge: string, expectedOrigin: string, expectedRPID: string) => Promise<Authentication>;
 //# sourceMappingURL=passkey.d.ts.map

package/dist/auth/passkey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/auth/passkey.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAGhD,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,UAAU,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAgBjE,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,MAAM,EACjB,UAAU,8BAA8B,CAAC,UAAU,CAAC,EACpD,mBAAmB,MAAM,KACxB,OAAO,CAAC,YAAY,CAmBtB,CAAC;AAGF,eAAO,MAAM,QAAQ,QAAa,OAAO,CACvC,OAAO,CAAC,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAU1D,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,MAAM,IAAI,CAAC,MAAM,EACjB,UAAU,gCAAgC,CAAC,UAAU,CAAC,EACtD,mBAAmB,MAAM,KACxB,OAAO,CAAC,cAAc,CAkBxB,CAAC"}
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/auth/passkey.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAGhD,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,UAAU,MAAM,EAChB,MAAM,MAAM,KACX,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAgBjE,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,MAAM,EACjB,UAAU,8BAA8B,CAAC,UAAU,CAAC,EACpD,mBAAmB,MAAM,EACzB,gBAAgB,MAAM,EACtB,cAAc,MAAM,KACnB,OAAO,CAAC,YAAY,CAmBtB,CAAC;AAGF,eAAO,MAAM,QAAQ,GACnB,MAAM,MAAM,KACX,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CASnE,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,MAAM,IAAI,CAAC,MAAM,EACjB,UAAU,gCAAgC,CAAC,UAAU,CAAC,EACtD,mBAAmB,MAAM,EACzB,gBAAgB,MAAM,EACtB,cAAc,MAAM,KACnB,OAAO,CAAC,cAAc,CAkBxB,CAAC"}

package/dist/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiB5B,KAAK,SAAS,GAAG;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,KACf,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAsc/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B5B,KAAK,SAAS,GAAG;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,KACf,IAAI,CAAC;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CA0c/B,CAAC"}

package/dist/index.js

@@ -399,7 +399,7 @@ var require_sqlite_error = __commonJS((exports, module) => {
 
 // node_modules/libsql/index.js
 var require_libsql = __commonJS((exports, module) => {
-  var __dirname = "/home/blakbelt78/Work/surrge/node_modules/libsql";
+  var __dirname = "/Users/eduardosasso/moonshot/surrge/node_modules/libsql";
   var { load, currentTarget } = require_dist();
   var { familySync, GLIBC } = require_detect_libc();
   function requireNative() {
@@ -14857,7 +14857,7 @@ var require_cjs5 = __commonJS((exports) => {
 // package.json
 var package_default = {
   name: "surrge",
-  version: "0.11.3",
+  version: "0.11.4",
   description: "One-line observability + analytics for Node.js/Bun",
   type: "module",
   exports: {
@@ -22391,8 +22391,6 @@ var trimTrailingSlash = () => {
 import { randomUUID } from "node:crypto";
 var challenges = new Map;
 var rpName = "surrge";
-var rpID = process.env.SURRGE_RP_ID || "localhost";
-var origin = process.env.SURRGE_ORIGIN || "http://localhost:3000";
 var secret = process.env.SURRGE_SECRET || randomUUID();
 
 // node_modules/@simplewebauthn/server/esm/helpers/iso/isoBase64URL.js
@@ -23978,7 +23976,7 @@ var defaultAuthenticatorSelection = {
 };
 var defaultSupportedAlgorithmIDs = [-8, -7, -257];
 async function generateRegistrationOptions(options) {
-  const { rpName: rpName2, rpID: rpID2, userName, userID, challenge = await generateChallenge(), userDisplayName = "", timeout = 60000, attestationType = "none", excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs } = options;
+  const { rpName: rpName2, rpID, userName, userID, challenge = await generateChallenge(), userDisplayName = "", timeout = 60000, attestationType = "none", excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs } = options;
   const pubKeyCredParams = supportedAlgorithmIDs.map((id) => ({
     alg: id,
     type: "public-key"
@@ -24005,7 +24003,7 @@ async function generateRegistrationOptions(options) {
     challenge: exports_isoBase64URL.fromBuffer(_challenge),
     rp: {
       name: rpName2,
-      id: rpID2
+      id: rpID
     },
     user: {
       id: exports_isoBase64URL.fromBuffer(_userID),
@@ -25445,7 +25443,7 @@ async function verifyRegistrationResponse(options) {
     throw new Error(`Unexpected credential type ${credentialType}, expected "public-key"`);
   }
   const clientDataJSON = decodeClientDataJSON(attestationResponse.clientDataJSON);
-  const { type, origin: origin2, challenge, tokenBinding } = clientDataJSON;
+  const { type, origin, challenge, tokenBinding } = clientDataJSON;
   if (Array.isArray(expectedType)) {
     if (!expectedType.includes(type)) {
       const joinedExpectedType = expectedType.join(", ");
@@ -25466,12 +25464,12 @@ async function verifyRegistrationResponse(options) {
     throw new Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);
   }
   if (Array.isArray(expectedOrigin)) {
-    if (!expectedOrigin.includes(origin2)) {
-      throw new Error(`Unexpected registration response origin "${origin2}", expected one of: ${expectedOrigin.join(", ")}`);
+    if (!expectedOrigin.includes(origin)) {
+      throw new Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`);
     }
   } else {
-    if (origin2 !== expectedOrigin) {
-      throw new Error(`Unexpected registration response origin "${origin2}", expected "${expectedOrigin}"`);
+    if (origin !== expectedOrigin) {
+      throw new Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);
     }
   }
   if (tokenBinding) {
@@ -25587,13 +25585,13 @@ async function verifyRegistrationResponse(options) {
 
 // node_modules/@simplewebauthn/server/esm/authentication/generateAuthenticationOptions.js
 async function generateAuthenticationOptions(options) {
-  const { allowCredentials, challenge = await generateChallenge(), timeout = 60000, userVerification = "preferred", extensions, rpID: rpID2 } = options;
+  const { allowCredentials, challenge = await generateChallenge(), timeout = 60000, userVerification = "preferred", extensions, rpID } = options;
   let _challenge = challenge;
   if (typeof _challenge === "string") {
     _challenge = exports_isoUint8Array.fromUTF8String(_challenge);
   }
   return {
-    rpId: rpID2,
+    rpId: rpID,
     challenge: exports_isoBase64URL.fromBuffer(_challenge),
     allowCredentials: allowCredentials?.map((cred) => {
       if (!exports_isoBase64URL.isBase64URL(cred.id)) {
@@ -25631,7 +25629,7 @@ async function verifyAuthenticationResponse(options) {
     throw new Error("Credential response clientDataJSON was not a string");
   }
   const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
-  const { type, origin: origin2, challenge, tokenBinding } = clientDataJSON;
+  const { type, origin, challenge, tokenBinding } = clientDataJSON;
   if (Array.isArray(expectedType)) {
     if (!expectedType.includes(type)) {
       const joinedExpectedType = expectedType.join(", ");
@@ -25652,13 +25650,13 @@ async function verifyAuthenticationResponse(options) {
     throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
   }
   if (Array.isArray(expectedOrigin)) {
-    if (!expectedOrigin.includes(origin2)) {
+    if (!expectedOrigin.includes(origin)) {
       const joinedExpectedOrigin = expectedOrigin.join(", ");
-      throw new Error(`Unexpected authentication response origin "${origin2}", expected one of: ${joinedExpectedOrigin}`);
+      throw new Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`);
     }
   } else {
-    if (origin2 !== expectedOrigin) {
-      throw new Error(`Unexpected authentication response origin "${origin2}", expected "${expectedOrigin}"`);
+    if (origin !== expectedOrigin) {
+      throw new Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);
     }
   }
   if (!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData)) {
@@ -25731,7 +25729,7 @@ async function verifyAuthenticationResponse(options) {
 }
 
 // src/auth/passkey.ts
-var challenge = async (username) => {
+var challenge = async (username, rpID) => {
   const options = await generateRegistrationOptions({
     rpName,
     rpID,
@@ -25746,12 +25744,12 @@ var challenge = async (username) => {
   challenges.set(username, options.challenge);
   return options;
 };
-var register = async (_username, response, expectedChallenge) => {
+var register = async (_username, response, expectedChallenge, expectedOrigin, expectedRPID) => {
   const verification = await verifyRegistrationResponse({
     response,
     expectedChallenge,
-    expectedOrigin: origin,
-    expectedRPID: rpID
+    expectedOrigin,
+    expectedRPID
   });
   if (!verification.verified || !verification.registrationInfo) {
     throw new Error("Verification failed");
@@ -25763,7 +25761,7 @@ var register = async (_username, response, expectedChallenge) => {
     counter: credential.counter
   };
 };
-var discover = async () => {
+var discover = async (rpID) => {
   const result = await generateAuthenticationOptions({
     rpID,
     userVerification: "required"
@@ -25771,12 +25769,12 @@ var discover = async () => {
   challenges.set(result.challenge, result.challenge);
   return result;
 };
-var authenticate = async (user, response, expectedChallenge) => {
+var authenticate = async (user, response, expectedChallenge, expectedOrigin, expectedRPID) => {
   const verification = await verifyAuthenticationResponse({
     response,
     expectedChallenge,
-    expectedOrigin: origin,
-    expectedRPID: rpID,
+    expectedOrigin,
+    expectedRPID,
     credential: {
       id: user.credential_id,
       publicKey: user.public_key,
@@ -26136,6 +26134,14 @@ Please change the parent <Route path="\${E}"> to <Route path="\${E==="/"?"*":\`\
 
 // src/dashboard/index.ts
 var SESSION_MAX_AGE = 30 * 24 * 60 * 60;
+var origin = (c) => {
+  const url = new URL(c.req.url);
+  return url.origin;
+};
+var hostname = (c) => {
+  const url = new URL(c.req.url);
+  return url.hostname;
+};
 var createDashboard = (basePath) => {
   const app = new Hono2().basePath(basePath);
   const auth = async (c, next) => {
@@ -26253,7 +26259,7 @@ var createDashboard = (basePath) => {
     if (!username?.trim()) {
       return c.json({ error: "Username required" }, 400);
     }
-    const options = await challenge(username);
+    const options = await challenge(username, hostname(c));
     return c.json(options);
   });
   app.post("/api/auth/register/verify", async (c) => {
@@ -26267,7 +26273,7 @@ var createDashboard = (basePath) => {
       return c.json({ error: "Challenge expired" }, 400);
     }
     try {
-      const registration = await register(username, credential, challenge2);
+      const registration = await register(username, credential, challenge2, origin(c), hostname(c));
       await create2({
         username,
         credential_id: registration.credential_id,
@@ -26294,7 +26300,7 @@ var createDashboard = (basePath) => {
     }
   });
   app.get("/api/auth/login", async (c) => {
-    const options = await discover();
+    const options = await discover(hostname(c));
     return c.json(options);
   });
   app.post("/api/auth/login/verify", async (c) => {
@@ -26317,7 +26323,7 @@ var createDashboard = (basePath) => {
       return c.json({ error: "Challenge expired" }, 400);
     }
     try {
-      const auth2 = await authenticate(user, credential, challenge2 || foundChallenge);
+      const auth2 = await authenticate(user, credential, challenge2 || foundChallenge, origin(c), hostname(c));
       await touch(user.username, auth2.counter);
       const token = create(user.username);
       setCookie(c, "session", token, {

package/dist/loader.js

@@ -399,7 +399,7 @@ var require_sqlite_error = __commonJS((exports, module) => {
 
 // node_modules/libsql/index.js
 var require_libsql = __commonJS((exports, module) => {
-  var __dirname = "/home/blakbelt78/Work/surrge/node_modules/libsql";
+  var __dirname = "/Users/eduardosasso/moonshot/surrge/node_modules/libsql";
   var { load, currentTarget } = require_dist();
   var { familySync, GLIBC } = require_detect_libc();
   function requireNative() {
@@ -14857,7 +14857,7 @@ var require_cjs5 = __commonJS((exports) => {
 // package.json
 var package_default = {
   name: "surrge",
-  version: "0.11.3",
+  version: "0.11.4",
   description: "One-line observability + analytics for Node.js/Bun",
   type: "module",
   exports: {
@@ -22391,8 +22391,6 @@ var trimTrailingSlash = () => {
 import { randomUUID } from "node:crypto";
 var challenges = new Map;
 var rpName = "surrge";
-var rpID = process.env.SURRGE_RP_ID || "localhost";
-var origin = process.env.SURRGE_ORIGIN || "http://localhost:3000";
 var secret = process.env.SURRGE_SECRET || randomUUID();
 
 // node_modules/@simplewebauthn/server/esm/helpers/iso/isoBase64URL.js
@@ -23978,7 +23976,7 @@ var defaultAuthenticatorSelection = {
 };
 var defaultSupportedAlgorithmIDs = [-8, -7, -257];
 async function generateRegistrationOptions(options) {
-  const { rpName: rpName2, rpID: rpID2, userName, userID, challenge = await generateChallenge(), userDisplayName = "", timeout = 60000, attestationType = "none", excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs } = options;
+  const { rpName: rpName2, rpID, userName, userID, challenge = await generateChallenge(), userDisplayName = "", timeout = 60000, attestationType = "none", excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs } = options;
   const pubKeyCredParams = supportedAlgorithmIDs.map((id) => ({
     alg: id,
     type: "public-key"
@@ -24005,7 +24003,7 @@ async function generateRegistrationOptions(options) {
     challenge: exports_isoBase64URL.fromBuffer(_challenge),
     rp: {
       name: rpName2,
-      id: rpID2
+      id: rpID
     },
     user: {
       id: exports_isoBase64URL.fromBuffer(_userID),
@@ -25445,7 +25443,7 @@ async function verifyRegistrationResponse(options) {
     throw new Error(`Unexpected credential type ${credentialType}, expected "public-key"`);
   }
   const clientDataJSON = decodeClientDataJSON(attestationResponse.clientDataJSON);
-  const { type, origin: origin2, challenge, tokenBinding } = clientDataJSON;
+  const { type, origin, challenge, tokenBinding } = clientDataJSON;
   if (Array.isArray(expectedType)) {
     if (!expectedType.includes(type)) {
       const joinedExpectedType = expectedType.join(", ");
@@ -25466,12 +25464,12 @@ async function verifyRegistrationResponse(options) {
     throw new Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);
   }
   if (Array.isArray(expectedOrigin)) {
-    if (!expectedOrigin.includes(origin2)) {
-      throw new Error(`Unexpected registration response origin "${origin2}", expected one of: ${expectedOrigin.join(", ")}`);
+    if (!expectedOrigin.includes(origin)) {
+      throw new Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`);
     }
   } else {
-    if (origin2 !== expectedOrigin) {
-      throw new Error(`Unexpected registration response origin "${origin2}", expected "${expectedOrigin}"`);
+    if (origin !== expectedOrigin) {
+      throw new Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);
     }
   }
   if (tokenBinding) {
@@ -25587,13 +25585,13 @@ async function verifyRegistrationResponse(options) {
 
 // node_modules/@simplewebauthn/server/esm/authentication/generateAuthenticationOptions.js
 async function generateAuthenticationOptions(options) {
-  const { allowCredentials, challenge = await generateChallenge(), timeout = 60000, userVerification = "preferred", extensions, rpID: rpID2 } = options;
+  const { allowCredentials, challenge = await generateChallenge(), timeout = 60000, userVerification = "preferred", extensions, rpID } = options;
   let _challenge = challenge;
   if (typeof _challenge === "string") {
     _challenge = exports_isoUint8Array.fromUTF8String(_challenge);
   }
   return {
-    rpId: rpID2,
+    rpId: rpID,
     challenge: exports_isoBase64URL.fromBuffer(_challenge),
     allowCredentials: allowCredentials?.map((cred) => {
       if (!exports_isoBase64URL.isBase64URL(cred.id)) {
@@ -25631,7 +25629,7 @@ async function verifyAuthenticationResponse(options) {
     throw new Error("Credential response clientDataJSON was not a string");
   }
   const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);
-  const { type, origin: origin2, challenge, tokenBinding } = clientDataJSON;
+  const { type, origin, challenge, tokenBinding } = clientDataJSON;
   if (Array.isArray(expectedType)) {
     if (!expectedType.includes(type)) {
       const joinedExpectedType = expectedType.join(", ");
@@ -25652,13 +25650,13 @@ async function verifyAuthenticationResponse(options) {
     throw new Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);
   }
   if (Array.isArray(expectedOrigin)) {
-    if (!expectedOrigin.includes(origin2)) {
+    if (!expectedOrigin.includes(origin)) {
       const joinedExpectedOrigin = expectedOrigin.join(", ");
-      throw new Error(`Unexpected authentication response origin "${origin2}", expected one of: ${joinedExpectedOrigin}`);
+      throw new Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`);
     }
   } else {
-    if (origin2 !== expectedOrigin) {
-      throw new Error(`Unexpected authentication response origin "${origin2}", expected "${expectedOrigin}"`);
+    if (origin !== expectedOrigin) {
+      throw new Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);
     }
   }
   if (!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData)) {
@@ -25731,7 +25729,7 @@ async function verifyAuthenticationResponse(options) {
 }
 
 // src/auth/passkey.ts
-var challenge = async (username) => {
+var challenge = async (username, rpID) => {
   const options = await generateRegistrationOptions({
     rpName,
     rpID,
@@ -25746,12 +25744,12 @@ var challenge = async (username) => {
   challenges.set(username, options.challenge);
   return options;
 };
-var register = async (_username, response, expectedChallenge) => {
+var register = async (_username, response, expectedChallenge, expectedOrigin, expectedRPID) => {
   const verification = await verifyRegistrationResponse({
     response,
     expectedChallenge,
-    expectedOrigin: origin,
-    expectedRPID: rpID
+    expectedOrigin,
+    expectedRPID
   });
   if (!verification.verified || !verification.registrationInfo) {
     throw new Error("Verification failed");
@@ -25763,7 +25761,7 @@ var register = async (_username, response, expectedChallenge) => {
     counter: credential.counter
   };
 };
-var discover = async () => {
+var discover = async (rpID) => {
   const result = await generateAuthenticationOptions({
     rpID,
     userVerification: "required"
@@ -25771,12 +25769,12 @@ var discover = async () => {
   challenges.set(result.challenge, result.challenge);
   return result;
 };
-var authenticate = async (user, response, expectedChallenge) => {
+var authenticate = async (user, response, expectedChallenge, expectedOrigin, expectedRPID) => {
   const verification = await verifyAuthenticationResponse({
     response,
     expectedChallenge,
-    expectedOrigin: origin,
-    expectedRPID: rpID,
+    expectedOrigin,
+    expectedRPID,
     credential: {
       id: user.credential_id,
       publicKey: user.public_key,
@@ -26136,6 +26134,14 @@ Please change the parent <Route path="\${E}"> to <Route path="\${E==="/"?"*":\`\
 
 // src/dashboard/index.ts
 var SESSION_MAX_AGE = 30 * 24 * 60 * 60;
+var origin = (c) => {
+  const url = new URL(c.req.url);
+  return url.origin;
+};
+var hostname = (c) => {
+  const url = new URL(c.req.url);
+  return url.hostname;
+};
 var createDashboard = (basePath) => {
   const app = new Hono2().basePath(basePath);
   const auth = async (c, next) => {
@@ -26253,7 +26259,7 @@ var createDashboard = (basePath) => {
     if (!username?.trim()) {
       return c.json({ error: "Username required" }, 400);
     }
-    const options = await challenge(username);
+    const options = await challenge(username, hostname(c));
     return c.json(options);
   });
   app.post("/api/auth/register/verify", async (c) => {
@@ -26267,7 +26273,7 @@ var createDashboard = (basePath) => {
       return c.json({ error: "Challenge expired" }, 400);
     }
     try {
-      const registration = await register(username, credential, challenge2);
+      const registration = await register(username, credential, challenge2, origin(c), hostname(c));
       await create2({
         username,
         credential_id: registration.credential_id,
@@ -26294,7 +26300,7 @@ var createDashboard = (basePath) => {
     }
   });
   app.get("/api/auth/login", async (c) => {
-    const options = await discover();
+    const options = await discover(hostname(c));
     return c.json(options);
   });
   app.post("/api/auth/login/verify", async (c) => {
@@ -26317,7 +26323,7 @@ var createDashboard = (basePath) => {
       return c.json({ error: "Challenge expired" }, 400);
     }
     try {
-      const auth2 = await authenticate(user, credential, challenge2 || foundChallenge);
+      const auth2 = await authenticate(user, credential, challenge2 || foundChallenge, origin(c), hostname(c));
       await touch(user.username, auth2.counter);
       const token = create(user.username);
       setCookie(c, "session", token, {