diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index de5e751..cb8a645 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -8,12 +8,14 @@ labels: bug
 A clear description of the bug.
 
 **Input type**
+
 - [ ] SAMLRequest
 - [ ] SAMLResponse
 - [ ] JWT
 - [ ] Other
 
 **Steps to reproduce**
+
 1. Paste ...
 2. See ...
 
@@ -24,6 +26,7 @@ What did you expect to see?
 What did you see instead?
 
 **Environment**
+
 - Browser:
 - OS:
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e365a3..efa9055 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,254 +2,224 @@
 
 ## [1.5.2](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.5.1...samlguy-v1.5.2) (2026-06-16)
 
-
 ### Security
 
-* **deps:** override ws to ^8.21.0 ([cc50d63](https://github.com/kellenmurphy/samlguy/commit/cc50d63c2b6bdb20097f7c07e2db8f6eedb1eac8))
+- **deps:** override ws to ^8.21.0 ([cc50d63](https://github.com/kellenmurphy/samlguy/commit/cc50d63c2b6bdb20097f7c07e2db8f6eedb1eac8))
 
 ## [1.5.1](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.5.0...samlguy-v1.5.1) (2026-06-13)
 
-
 ### Security
 
-* **deps:** override esbuild to ^0.28.1 ([5dbc4ae](https://github.com/kellenmurphy/samlguy/commit/5dbc4aef3c355a7fbbf19066248df3e21ea0c019))
+- **deps:** override esbuild to ^0.28.1 ([5dbc4ae](https://github.com/kellenmurphy/samlguy/commit/5dbc4aef3c355a7fbbf19066248df3e21ea0c019))
 
 ## [1.5.0](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.4.1...samlguy-v1.5.0) (2026-06-07)
 
-
 ### Features
 
-* link the footer to the current release version ([13f23b9](https://github.com/kellenmurphy/samlguy/commit/13f23b96673d9a660771416657dbe2eefb9452b6))
-* **metadata:** decode SAML metadata with health checks ([c26b772](https://github.com/kellenmurphy/samlguy/commit/c26b772f7b940ab9f57e5ddcfbf5f758637ef97a))
-* **metadata:** SAML metadata decoder with health checks ([74566bd](https://github.com/kellenmurphy/samlguy/commit/74566bd5bf98857965289d3e090a426f17ac166c))
-
+- link the footer to the current release version ([13f23b9](https://github.com/kellenmurphy/samlguy/commit/13f23b96673d9a660771416657dbe2eefb9452b6))
+- **metadata:** decode SAML metadata with health checks ([c26b772](https://github.com/kellenmurphy/samlguy/commit/c26b772f7b940ab9f57e5ddcfbf5f758637ef97a))
+- **metadata:** SAML metadata decoder with health checks ([74566bd](https://github.com/kellenmurphy/samlguy/commit/74566bd5bf98857965289d3e090a426f17ac166c))
 
 ### Bug Fixes & Dependencies
 
-* **metadata:** avoid ReDoS in isMetadata detection ([d0abd2e](https://github.com/kellenmurphy/samlguy/commit/d0abd2eee3dbcc86a69c00cfb26b0a0d278739fa))
+- **metadata:** avoid ReDoS in isMetadata detection ([d0abd2e](https://github.com/kellenmurphy/samlguy/commit/d0abd2eee3dbcc86a69c00cfb26b0a0d278739fa))
 
 ## [1.4.1](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.4.0...samlguy-v1.4.1) (2026-06-03)
 
-
 ### Bug Fixes & Dependencies
 
-* **ci:** drop unused deployments:write permission from deploy job ([#99](https://github.com/kellenmurphy/samlguy/issues/99)) ([20a61df](https://github.com/kellenmurphy/samlguy/commit/20a61df76fad8f4ba1cfba67b5ac1a0e05ca3270))
+- **ci:** drop unused deployments:write permission from deploy job ([#99](https://github.com/kellenmurphy/samlguy/issues/99)) ([20a61df](https://github.com/kellenmurphy/samlguy/commit/20a61df76fad8f4ba1cfba67b5ac1a0e05ca3270))
 
 ## [1.4.0](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.7...samlguy-v1.4.0) (2026-05-28)
 
-
 ### Features
 
-* **security:** implement Content Security Policy ([#82](https://github.com/kellenmurphy/samlguy/issues/82)) ([ed26434](https://github.com/kellenmurphy/samlguy/commit/ed2643412d85686938fa3f8e98dea566db38e8e3))
+- **security:** implement Content Security Policy ([#82](https://github.com/kellenmurphy/samlguy/issues/82)) ([ed26434](https://github.com/kellenmurphy/samlguy/commit/ed2643412d85686938fa3f8e98dea566db38e8e3))
 
 ## [1.3.7](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.6...samlguy-v1.3.7) (2026-05-28)
 
-
 ### Bug Fixes & Dependencies
 
-* **discover:** reject IP-literal issuers; fix CORS and logging docs ([#79](https://github.com/kellenmurphy/samlguy/issues/79)) ([67ac50e](https://github.com/kellenmurphy/samlguy/commit/67ac50e76218bf6bf0536d1dcf3154ff6c115b94))
+- **discover:** reject IP-literal issuers; fix CORS and logging docs ([#79](https://github.com/kellenmurphy/samlguy/issues/79)) ([67ac50e](https://github.com/kellenmurphy/samlguy/commit/67ac50e76218bf6bf0536d1dcf3154ff6c115b94))
 
 ## [1.3.6](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.5...samlguy-v1.3.6) (2026-05-28)
 
-
 ### Documentation
 
-* **security:** correct token permissions and branch protection descriptions ([#77](https://github.com/kellenmurphy/samlguy/issues/77)) ([0fd12e1](https://github.com/kellenmurphy/samlguy/commit/0fd12e1c1247797c35ab0ad19ebb02ff4ac5fb01))
+- **security:** correct token permissions and branch protection descriptions ([#77](https://github.com/kellenmurphy/samlguy/issues/77)) ([0fd12e1](https://github.com/kellenmurphy/samlguy/commit/0fd12e1c1247797c35ab0ad19ebb02ff4ac5fb01))
 
 ## [1.3.5](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.4...samlguy-v1.3.5) (2026-05-28)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump eslint-plugin-svelte from 3.17.1 to 3.18.0 ([#72](https://github.com/kellenmurphy/samlguy/issues/72)) ([21811a8](https://github.com/kellenmurphy/samlguy/commit/21811a84f2cc306486b3cb2b9f50613a3244d6c8))
+- **deps-dev:** bump eslint-plugin-svelte from 3.17.1 to 3.18.0 ([#72](https://github.com/kellenmurphy/samlguy/issues/72)) ([21811a8](https://github.com/kellenmurphy/samlguy/commit/21811a84f2cc306486b3cb2b9f50613a3244d6c8))
 
 ## [1.3.4](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.3...samlguy-v1.3.4) (2026-05-28)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump svelte from 5.55.9 to 5.55.10 in the svelte group ([#71](https://github.com/kellenmurphy/samlguy/issues/71)) ([a9972cb](https://github.com/kellenmurphy/samlguy/commit/a9972cb1f5649c5dd10ae68ce27d96ad0b61441a))
+- **deps-dev:** bump svelte from 5.55.9 to 5.55.10 in the svelte group ([#71](https://github.com/kellenmurphy/samlguy/issues/71)) ([a9972cb](https://github.com/kellenmurphy/samlguy/commit/a9972cb1f5649c5dd10ae68ce27d96ad0b61441a))
 
 ## [1.3.3](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.2...samlguy-v1.3.3) (2026-05-27)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump wrangler in the cloudflare group ([#69](https://github.com/kellenmurphy/samlguy/issues/69)) ([d65dcec](https://github.com/kellenmurphy/samlguy/commit/d65dcec70c1b9710c253407def342a1a15ae39ba))
+- **deps-dev:** bump wrangler in the cloudflare group ([#69](https://github.com/kellenmurphy/samlguy/issues/69)) ([d65dcec](https://github.com/kellenmurphy/samlguy/commit/d65dcec70c1b9710c253407def342a1a15ae39ba))
 
 ## [1.3.2](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.1...samlguy-v1.3.2) (2026-05-26)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump typescript-eslint from 8.59.4 to 8.60.0 ([#67](https://github.com/kellenmurphy/samlguy/issues/67)) ([a15291a](https://github.com/kellenmurphy/samlguy/commit/a15291af5fbef30933bf3ed8e46d5d2e65e2ebf6))
+- **deps-dev:** bump typescript-eslint from 8.59.4 to 8.60.0 ([#67](https://github.com/kellenmurphy/samlguy/issues/67)) ([a15291a](https://github.com/kellenmurphy/samlguy/commit/a15291af5fbef30933bf3ed8e46d5d2e65e2ebf6))
 
 ## [1.3.1](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.3.0...samlguy-v1.3.1) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **examples:** remove incorrect POST binding query string example ([984cc30](https://github.com/kellenmurphy/samlguy/commit/984cc30a536cadfe18d84a72113f29ece2c085c9))
-* **examples:** remove incorrect POST binding query string example ([264e1ca](https://github.com/kellenmurphy/samlguy/commit/264e1ca30d3c133550064111d7230a6beec16338))
+- **examples:** remove incorrect POST binding query string example ([984cc30](https://github.com/kellenmurphy/samlguy/commit/984cc30a536cadfe18d84a72113f29ece2c085c9))
+- **examples:** remove incorrect POST binding query string example ([264e1ca](https://github.com/kellenmurphy/samlguy/commit/264e1ca30d3c133550064111d7230a6beec16338))
 
 ## [1.3.0](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.7...samlguy-v1.3.0) (2026-05-25)
 
-
 ### Features
 
-* InCommon attribute annotations, Examples button, and Authorization header fix ([7b85bd5](https://github.com/kellenmurphy/samlguy/commit/7b85bd5271c323d98f26ce7879a62dd691a7e793))
-* **saml:** add InCommon R&S and eppn-scoped badge annotations to the attribute table ([13f4ae6](https://github.com/kellenmurphy/samlguy/commit/13f4ae685399e114d93977c9827bb2f13a3603e3))
-* **ui:** add attribute badge UI and Examples button with 10 dynamic payloads ([c0b1677](https://github.com/kellenmurphy/samlguy/commit/c0b1677eaf0907430e8781b98f9b9ce88b6a4b33))
-
+- InCommon attribute annotations, Examples button, and Authorization header fix ([7b85bd5](https://github.com/kellenmurphy/samlguy/commit/7b85bd5271c323d98f26ce7879a62dd691a7e793))
+- **saml:** add InCommon R&S and eppn-scoped badge annotations to the attribute table ([13f4ae6](https://github.com/kellenmurphy/samlguy/commit/13f4ae685399e114d93977c9827bb2f13a3603e3))
+- **ui:** add attribute badge UI and Examples button with 10 dynamic payloads ([c0b1677](https://github.com/kellenmurphy/samlguy/commit/c0b1677eaf0907430e8781b98f9b9ce88b6a4b33))
 
 ### Bug Fixes & Dependencies
 
-* **jwt:** handle full Authorization: Bearer header line in decodeJwt ([a73e733](https://github.com/kellenmurphy/samlguy/commit/a73e7339687205465c6b8a03752b2beb30003d05))
-
+- **jwt:** handle full Authorization: Bearer header line in decodeJwt ([a73e733](https://github.com/kellenmurphy/samlguy/commit/a73e7339687205465c6b8a03752b2beb30003d05))
 
 ### Documentation
 
-* update README for attribute annotations and Examples button ([c0ff7a5](https://github.com/kellenmurphy/samlguy/commit/c0ff7a54670dd35ea06310eb923e635145efa377))
+- update README for attribute annotations and Examples button ([c0ff7a5](https://github.com/kellenmurphy/samlguy/commit/c0ff7a54670dd35ea06310eb923e635145efa377))
 
 ## [1.2.7](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.6...samlguy-v1.2.7) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump wrangler from 4.92.0 to 4.94.0 in the cloudflare group across 1 directory ([33eaa94](https://github.com/kellenmurphy/samlguy/commit/33eaa9451e5b13fc1848786bf69ed1cba6ea0fc0))
-* **deps-dev:** bump wrangler in the cloudflare group across 1 directory ([519a8f2](https://github.com/kellenmurphy/samlguy/commit/519a8f2ab8fa581427699996132ebcd50ee23d88))
+- **deps-dev:** bump wrangler from 4.92.0 to 4.94.0 in the cloudflare group across 1 directory ([33eaa94](https://github.com/kellenmurphy/samlguy/commit/33eaa9451e5b13fc1848786bf69ed1cba6ea0fc0))
+- **deps-dev:** bump wrangler in the cloudflare group across 1 directory ([519a8f2](https://github.com/kellenmurphy/samlguy/commit/519a8f2ab8fa581427699996132ebcd50ee23d88))
 
 ## [1.2.6](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.5...samlguy-v1.2.6) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump prettier-plugin-svelte from 3.5.2 to 4.0.1 ([76302e2](https://github.com/kellenmurphy/samlguy/commit/76302e2d3ed11553c3cb09a8f3d554583a71c737))
-* **deps-dev:** bump prettier-plugin-svelte from 3.5.2 to 4.0.1 ([647c018](https://github.com/kellenmurphy/samlguy/commit/647c018f3329c65a269980330d684889b684101c))
+- **deps-dev:** bump prettier-plugin-svelte from 3.5.2 to 4.0.1 ([76302e2](https://github.com/kellenmurphy/samlguy/commit/76302e2d3ed11553c3cb09a8f3d554583a71c737))
+- **deps-dev:** bump prettier-plugin-svelte from 3.5.2 to 4.0.1 ([647c018](https://github.com/kellenmurphy/samlguy/commit/647c018f3329c65a269980330d684889b684101c))
 
 ## [1.2.5](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.4...samlguy-v1.2.5) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump vite from 8.0.13 to 8.0.14 ([e8f3498](https://github.com/kellenmurphy/samlguy/commit/e8f349864d87b2d08da5a3e3b0d14ed47912e913))
-* **deps-dev:** bump vite from 8.0.13 to 8.0.14 ([c4f8719](https://github.com/kellenmurphy/samlguy/commit/c4f8719503494727c6196e94667cd376e842252b))
+- **deps-dev:** bump vite from 8.0.13 to 8.0.14 ([e8f3498](https://github.com/kellenmurphy/samlguy/commit/e8f349864d87b2d08da5a3e3b0d14ed47912e913))
+- **deps-dev:** bump vite from 8.0.13 to 8.0.14 ([c4f8719](https://github.com/kellenmurphy/samlguy/commit/c4f8719503494727c6196e94667cd376e842252b))
 
 ## [1.2.4](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.3...samlguy-v1.2.4) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump typescript-eslint from 8.59.3 to 8.59.4 ([71d9d99](https://github.com/kellenmurphy/samlguy/commit/71d9d9975f68ed2fcfa1836f72f27244488f725f))
-* **deps-dev:** bump typescript-eslint from 8.59.3 to 8.59.4 ([81e6fee](https://github.com/kellenmurphy/samlguy/commit/81e6fee44eb56c1d65a2ebb03d250a0a9bebca02))
+- **deps-dev:** bump typescript-eslint from 8.59.3 to 8.59.4 ([71d9d99](https://github.com/kellenmurphy/samlguy/commit/71d9d9975f68ed2fcfa1836f72f27244488f725f))
+- **deps-dev:** bump typescript-eslint from 8.59.3 to 8.59.4 ([81e6fee](https://github.com/kellenmurphy/samlguy/commit/81e6fee44eb56c1d65a2ebb03d250a0a9bebca02))
 
 ## [1.2.3](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.2...samlguy-v1.2.3) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump the svelte group across 1 directory with 2 updates ([ab6991f](https://github.com/kellenmurphy/samlguy/commit/ab6991f5a51b13836e621c6cb41bef7b113595db))
-* **deps-dev:** bump the svelte group across 1 directory with 2 updates ([ac95bd4](https://github.com/kellenmurphy/samlguy/commit/ac95bd43bff0ee72696a05c081fd365881faa1ed))
+- **deps-dev:** bump the svelte group across 1 directory with 2 updates ([ab6991f](https://github.com/kellenmurphy/samlguy/commit/ab6991f5a51b13836e621c6cb41bef7b113595db))
+- **deps-dev:** bump the svelte group across 1 directory with 2 updates ([ac95bd4](https://github.com/kellenmurphy/samlguy/commit/ac95bd43bff0ee72696a05c081fd365881faa1ed))
 
 ## [1.2.2](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.1...samlguy-v1.2.2) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump vitest from 4.1.6 to 4.1.7 ([1e92ecf](https://github.com/kellenmurphy/samlguy/commit/1e92ecf83b27602c5d5b3dc04cf0cf5c139fb0e7))
-* **deps-dev:** bump vitest from 4.1.6 to 4.1.7 ([69d5ee7](https://github.com/kellenmurphy/samlguy/commit/69d5ee7f6a0269bbf06a3a390ac596b6c396bd89))
+- **deps-dev:** bump vitest from 4.1.6 to 4.1.7 ([1e92ecf](https://github.com/kellenmurphy/samlguy/commit/1e92ecf83b27602c5d5b3dc04cf0cf5c139fb0e7))
+- **deps-dev:** bump vitest from 4.1.6 to 4.1.7 ([69d5ee7](https://github.com/kellenmurphy/samlguy/commit/69d5ee7f6a0269bbf06a3a390ac596b6c396bd89))
 
 ## [1.2.1](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.2.0...samlguy-v1.2.1) (2026-05-25)
 
-
 ### Bug Fixes & Dependencies
 
-* **deps-dev:** bump @types/node from 25.8.0 to 25.9.1 ([0b663b6](https://github.com/kellenmurphy/samlguy/commit/0b663b689d8da83664b46e5bb4a6fbce9c844546))
-* **deps-dev:** bump @types/node from 25.8.0 to 25.9.1 ([d93898f](https://github.com/kellenmurphy/samlguy/commit/d93898fdcc5c5e910151668d41ac7bbd5d626704))
+- **deps-dev:** bump @types/node from 25.8.0 to 25.9.1 ([0b663b6](https://github.com/kellenmurphy/samlguy/commit/0b663b689d8da83664b46e5bb4a6fbce9c844546))
+- **deps-dev:** bump @types/node from 25.8.0 to 25.9.1 ([d93898f](https://github.com/kellenmurphy/samlguy/commit/d93898fdcc5c5e910151668d41ac7bbd5d626704))
 
 ## [1.2.0](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.1.2...samlguy-v1.2.0) (2026-05-16)
 
-
 ### Features
 
-* AuthnContext labels, status descriptions, XML highlighting, and shareable links ([944a870](https://github.com/kellenmurphy/samlguy/commit/944a87088f9c58bce592c1813c0adea13a9ae672))
-* **saml:** add AuthnContext labels, status descriptions, spec links, and XML line wrapping ([5551b29](https://github.com/kellenmurphy/samlguy/commit/5551b291d4dc73e46e8db825415a54570e9701f6))
-* **ui:** add XML syntax highlighting with hoverable element tooltips ([424f8a5](https://github.com/kellenmurphy/samlguy/commit/424f8a5a369e9bdaab295e0d67ef31b2762a08ec))
-
+- AuthnContext labels, status descriptions, XML highlighting, and shareable links ([944a870](https://github.com/kellenmurphy/samlguy/commit/944a87088f9c58bce592c1813c0adea13a9ae672))
+- **saml:** add AuthnContext labels, status descriptions, spec links, and XML line wrapping ([5551b29](https://github.com/kellenmurphy/samlguy/commit/5551b291d4dc73e46e8db825415a54570e9701f6))
+- **ui:** add XML syntax highlighting with hoverable element tooltips ([424f8a5](https://github.com/kellenmurphy/samlguy/commit/424f8a5a369e9bdaab295e0d67ef31b2762a08ec))
 
 ### Bug Fixes & Dependencies
 
-* **ui:** update logo to <saml:Guy/> with white brackets ([28ec246](https://github.com/kellenmurphy/samlguy/commit/28ec246d6986448669b964f00c27cf5815e51abb))
-
+- **ui:** update logo to <saml:Guy/> with white brackets ([28ec246](https://github.com/kellenmurphy/samlguy/commit/28ec246d6986448669b964f00c27cf5815e51abb))
 
 ### Documentation
 
-* update CLAUDE.md and README for shipped features ([f46a343](https://github.com/kellenmurphy/samlguy/commit/f46a34361863b26ca0236047854a7ac44961ad2c))
+- update CLAUDE.md and README for shipped features ([f46a343](https://github.com/kellenmurphy/samlguy/commit/f46a34361863b26ca0236047854a7ac44961ad2c))
 
 ## [1.1.2](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.1.1...samlguy-v1.1.2) (2026-05-16)
 
-
 ### Bug Fixes & Dependencies
 
-* footer layout and CI token permissions ([07ef730](https://github.com/kellenmurphy/samlguy/commit/07ef7307cfe15984798587c4ec2ddfff73552633))
-* **ui:** stack footer attribution above links ([440b5a1](https://github.com/kellenmurphy/samlguy/commit/440b5a16d68289df926f365dbaae91d91357bcae))
+- footer layout and CI token permissions ([07ef730](https://github.com/kellenmurphy/samlguy/commit/07ef7307cfe15984798587c4ec2ddfff73552633))
+- **ui:** stack footer attribution above links ([440b5a1](https://github.com/kellenmurphy/samlguy/commit/440b5a16d68289df926f365dbaae91d91357bcae))
 
 ## [1.1.1](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.1.0...samlguy-v1.1.1) (2026-05-16)
 
-
 ### Bug Fixes & Dependencies
 
-* **ci:** trigger CI via label instead of workflow dispatch ([347af49](https://github.com/kellenmurphy/samlguy/commit/347af49faceba4257637f24055b49aa26d875c2a))
-* **ci:** trigger CI via label; bump dev deps ([9ec17d9](https://github.com/kellenmurphy/samlguy/commit/9ec17d9bd43f5486df1df9b73efa763a20bdf368))
-* **deps:** bump dev dependencies to latest ([7fc3a22](https://github.com/kellenmurphy/samlguy/commit/7fc3a22cf3d9c9f81bb964b093eaf11925ca0a69))
+- **ci:** trigger CI via label instead of workflow dispatch ([347af49](https://github.com/kellenmurphy/samlguy/commit/347af49faceba4257637f24055b49aa26d875c2a))
+- **ci:** trigger CI via label; bump dev deps ([9ec17d9](https://github.com/kellenmurphy/samlguy/commit/9ec17d9bd43f5486df1df9b73efa763a20bdf368))
+- **deps:** bump dev dependencies to latest ([7fc3a22](https://github.com/kellenmurphy/samlguy/commit/7fc3a22cf3d9c9f81bb964b093eaf11925ca0a69))
 
 ## [1.1.0](https://github.com/kellenmurphy/samlguy/compare/samlguy-v1.0.0...samlguy-v1.1.0) (2026-05-16)
 
-
 ### Features
 
-* add release-please for automated changelog and GitHub releases ([74ff54f](https://github.com/kellenmurphy/samlguy/commit/74ff54f10c1328b81630a285dada4b0767a14555))
-
+- add release-please for automated changelog and GitHub releases ([74ff54f](https://github.com/kellenmurphy/samlguy/commit/74ff54f10c1328b81630a285dada4b0767a14555))
 
 ### Bug Fixes & Dependencies
 
-* automate release PR approval, merge, and CI trigger ([8dd5876](https://github.com/kellenmurphy/samlguy/commit/8dd5876cb77590857b8d2d8bb7a6f442a0e633ff))
-* automate release PR approval, merge, and CI trigger ([9e7f2f3](https://github.com/kellenmurphy/samlguy/commit/9e7f2f3ff30e45a9781d26630ca2eac61ec8d6aa))
-* **ci:** add --repo flag to gh commands in release-please workflow ([e464d81](https://github.com/kellenmurphy/samlguy/commit/e464d81027a025b419d039a6de602c75d4f5aaf3))
-* **ci:** add --repo flag to gh commands in release-please workflow ([5a4131d](https://github.com/kellenmurphy/samlguy/commit/5a4131d4dd096daab615e9dd4c489deb2c42b4f8))
-* release automation, security headers, and doc updates ([3d2c15e](https://github.com/kellenmurphy/samlguy/commit/3d2c15ed31f149c83d34a91de63f539af27adad1))
-* release automation, security headers, and doc updates ([d390500](https://github.com/kellenmurphy/samlguy/commit/d3905008857a066dcdb90aa723bf31562f220bc9))
+- automate release PR approval, merge, and CI trigger ([8dd5876](https://github.com/kellenmurphy/samlguy/commit/8dd5876cb77590857b8d2d8bb7a6f442a0e633ff))
+- automate release PR approval, merge, and CI trigger ([9e7f2f3](https://github.com/kellenmurphy/samlguy/commit/9e7f2f3ff30e45a9781d26630ca2eac61ec8d6aa))
+- **ci:** add --repo flag to gh commands in release-please workflow ([e464d81](https://github.com/kellenmurphy/samlguy/commit/e464d81027a025b419d039a6de602c75d4f5aaf3))
+- **ci:** add --repo flag to gh commands in release-please workflow ([5a4131d](https://github.com/kellenmurphy/samlguy/commit/5a4131d4dd096daab615e9dd4c489deb2c42b4f8))
+- release automation, security headers, and doc updates ([3d2c15e](https://github.com/kellenmurphy/samlguy/commit/3d2c15ed31f149c83d34a91de63f539af27adad1))
+- release automation, security headers, and doc updates ([d390500](https://github.com/kellenmurphy/samlguy/commit/d3905008857a066dcdb90aa723bf31562f220bc9))
 
 ## [1.0.0](https://github.com/kellenmurphy/samlguy/releases/tag/v1.0.0) (2026-05-16)
 
 ### Features
 
-* Smart input detection — paste raw base64+DEFLATE (HTTP-Redirect), raw base64 (HTTP-POST), query strings, full URLs, HTTP log lines, or `Authorization: Bearer` headers; the tool figures out what it is
-* SAML decoder with summary panel (binding, message type, status, issuer, destination, ACS URL, NameID, InResponseTo, RelayState, encryption flags), timestamp math, signing certificate details (subject, issuer, key algorithm, validity), attribute statement table, and pretty-printed XML
-* JWT / OIDC decoder with algorithm warnings (`alg: none` danger, HMAC weak badge), timestamp analysis, scope display, and raw header/payload JSON
-* X.509 certificate parser — pure DER/ASN.1 implementation, no external library; handles RSA, EC, UTCTime, GeneralizedTime, and unknown OIDs
-* OIDC Discovery — Discover button on the `iss` field fetches `.well-known/openid-configuration` server-side via Cloudflare Worker; surfaces issuer match, supported algorithms, JWKS URI, and endpoint URLs
-* Shareable links — Copy link button encodes the current input into the URL fragment (`#`); the fragment never reaches the server
-* InfoTip contextual help tooltips on every summary field, covering SAML spec, JWT/OIDC standards, OAuth 2.0 scopes, and common federation conventions
-* Light / dark mode toggle with `localStorage` persistence
-* Privacy policy page
+- Smart input detection — paste raw base64+DEFLATE (HTTP-Redirect), raw base64 (HTTP-POST), query strings, full URLs, HTTP log lines, or `Authorization: Bearer` headers; the tool figures out what it is
+- SAML decoder with summary panel (binding, message type, status, issuer, destination, ACS URL, NameID, InResponseTo, RelayState, encryption flags), timestamp math, signing certificate details (subject, issuer, key algorithm, validity), attribute statement table, and pretty-printed XML
+- JWT / OIDC decoder with algorithm warnings (`alg: none` danger, HMAC weak badge), timestamp analysis, scope display, and raw header/payload JSON
+- X.509 certificate parser — pure DER/ASN.1 implementation, no external library; handles RSA, EC, UTCTime, GeneralizedTime, and unknown OIDs
+- OIDC Discovery — Discover button on the `iss` field fetches `.well-known/openid-configuration` server-side via Cloudflare Worker; surfaces issuer match, supported algorithms, JWKS URI, and endpoint URLs
+- Shareable links — Copy link button encodes the current input into the URL fragment (`#`); the fragment never reaches the server
+- InfoTip contextual help tooltips on every summary field, covering SAML spec, JWT/OIDC standards, OAuth 2.0 scopes, and common federation conventions
+- Light / dark mode toggle with `localStorage` persistence
+- Privacy policy page
 
 ### Bug Fixes & Dependencies
 
-* Fix overscroll background flash on mobile
-* Fix coverage reporters: configure lcov output in vitest config rather than CLI flag
-* Fix devalue and svelte audit vulnerabilities
-* Bump all dependencies to latest
+- Fix overscroll background flash on mobile
+- Fix coverage reporters: configure lcov output in vitest config rather than CLI flag
+- Fix devalue and svelte audit vulnerabilities
+- Bump all dependencies to latest
 
 ### Security
 
-* OSSF Scorecard workflow — weekly evaluation of supply-chain security practices, results published to GitHub code scanning dashboard
-* CodeQL advanced setup — `security-extended` query suite on every push and PR to `main`
-* SHA-pinned GitHub Actions across all workflows
-* Commit signing via SSH key (1Password agent); all commits to `main` carry verified signatures
-* Property-based fuzz tests (fast-check) covering all parsers: SAML decoder, JWT decoder, X.509 DER/ASN.1 parser, generic fallback decoder
-* SECURITY.md: vulnerability reporting via GitHub private advisory; full disclosure of data flow, supply chain controls, branch protection, and fuzzing approach
+- OSSF Scorecard workflow — weekly evaluation of supply-chain security practices, results published to GitHub code scanning dashboard
+- CodeQL advanced setup — `security-extended` query suite on every push and PR to `main`
+- SHA-pinned GitHub Actions across all workflows
+- Commit signing via SSH key (1Password agent); all commits to `main` carry verified signatures
+- Property-based fuzz tests (fast-check) covering all parsers: SAML decoder, JWT decoder, X.509 DER/ASN.1 parser, generic fallback decoder
+- SECURITY.md: vulnerability reporting via GitHub private advisory; full disclosure of data flow, supply chain controls, branch protection, and fuzzing approach
 
 ### Documentation
 
-* MIT license
+- MIT license
diff --git a/CLAUDE.md b/CLAUDE.md
index 6a8680b..72738c7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -28,6 +28,7 @@ The core UX premise: paste whatever messy thing you grabbed from a log file, a n
 A single `<textarea>` input. The `detect()` function determines whether the input is a JWT (three-part dot-separated base64url, or starts with `Authorization: Bearer`) or SAML (everything else). A debounced `$effect` drives decoding on a 300ms timer.
 
 The page handles:
+
 - Multiple SAML messages in one paste (`decodeAllSaml` scans for all `SAMLRequest`/`SAMLResponse` params)
 - Generic fallback decoding (`decodeAllGeneric`) for non-SAML base64/XML/JSON blobs
 - Lazy-loaded cert decoding via dynamic `import('$lib/cert')` to avoid blocking first render
@@ -60,6 +61,7 @@ The page handles:
 ### JWT decode library (`src/lib/jwt.ts`)
 
 `decodeJwt(input)` — strips `Bearer` prefix, splits on `.`, base64url-decodes header and payload, returns typed `JwtDecodeResult` with:
+
 - `isAlgNone` / `isWeakAlg` flags
 - `timestamps` object (`iat`, `exp`, `nbf` as `JwtTimestamp` with `date`, `label`, `expired`)
 - `scopes` array (handles both `scope` string and `scp` array claim variants)
@@ -105,6 +107,7 @@ All tooltip text externalized as `FIELD_EXPLANATIONS: Record<string, string>` wi
 ## Test coverage
 
 100% statements, branches, functions, and lines across all `src/lib/` modules. Achieved via:
+
 - `/* v8 ignore next */` directives on defensive null-guards that are unreachable in valid DER/XML (never in `parseName`, `parseKeyAlg`, etc.)
 - Carefully crafted DER certificate fixtures (single-line base64, length divisible by 4 — jsdom's `atob()` is strict, unlike Node's `Buffer.from()`)
 - Test cases for every edge path: UTCTime year ≥ 50, EC with no curve OID, RSA modulus without leading zero, unknown DN attribute OIDs, all SAML timestamp variants, JWT non-string alg, etc.
@@ -135,10 +138,12 @@ Run with: `npm run coverage`
 ## Planned features
 
 ### Medium priority
+
 - **SAML signature validation** — fetch the IdP's SAML metadata (by EntityID or URL), extract the signing cert, and verify `<ds:Signature>` using the Web Crypto API. Display verified/unverified status prominently.
 - **JWT JWKS validation** — after OIDC discovery, fetch `jwks_uri` and attempt to verify the JWT signature against the matching key.
 
 ### Lower priority / ideas
+
 - **MDQ discovery** — fetch an entity's metadata from InCommon's MDQ service by EntityID and feed it into the metadata view (`src/lib/metadata.ts`)
 - **REFEDS entity category checker** — cross-check an SP's `RequestedAttribute`s against entity categories already parsed by the metadata view
 - **i18n** — `explanations.ts` is already structured for this; add a locale switcher and alternate record implementations
@@ -157,15 +162,15 @@ Optional body explaining why, not what.
 
 ### Types and their effects
 
-| Type | Version bump | Changelog section |
-|------|-------------|-------------------|
-| `feat` | minor (1.x.0) | Features |
-| `fix` | patch (1.0.x) | Bug Fixes & Dependencies |
-| `perf` | patch | Performance |
+| Type       | Version bump        | Changelog section                        |
+| ---------- | ------------------- | ---------------------------------------- |
+| `feat`     | minor (1.x.0)       | Features                                 |
+| `fix`      | patch (1.0.x)       | Bug Fixes & Dependencies                 |
+| `perf`     | patch               | Performance                              |
 | `security` | none (display only) | Security — use `fix` if a bump is needed |
-| `docs` | none | Documentation (visible) |
-| `chore` | none | Miscellaneous (hidden) |
-| `ci` | none | CI/CD (hidden) |
+| `docs`     | none                | Documentation (visible)                  |
+| `chore`    | none                | Miscellaneous (hidden)                   |
+| `ci`       | none                | CI/CD (hidden)                           |
 
 Breaking changes: add `!` after the type (`feat!:` or `fix!:`) **or** include a `BREAKING CHANGE:` footer. Either triggers a major bump (x.0.0).
 
@@ -184,9 +189,11 @@ Commits that don't match any of the above types (e.g. `Add something` with no ty
 Before any structural refactor on a file >300 LOC, remove dead props, unused exports, and debug logs. Commit separately.
 
 After any significant change, run:
+
 ```bash
 npx tsc --noEmit && npx eslint . --quiet && npm run coverage
 ```
+
 All three must pass before reporting work complete.
 
 ESLint config note: `svelte/no-navigation-without-resolve` is configured with `ignoreLinks: true` because samlguy.com deploys at the root with no base path, making `resolve()` unnecessary for plain `href="/"` links.
diff --git a/README.md b/README.md
index eabff55..545f4e9 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,8 @@
 <div align="center">
 
 # `<saml:Guy/>`
-**[*samlguy.com*](https://samlguy.com) — A SAML assertion and JWT decoder for the IAM community.**
+
+**[_samlguy.com_](https://samlguy.com) — A SAML assertion and JWT decoder for the IAM community.**
 
 [![CI](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml) [![codecov](https://codecov.io/gh/kellenmurphy/samlguy/graph/badge.svg)](https://codecov.io/gh/kellenmurphy/samlguy) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12859/badge)](https://www.bestpractices.dev/projects/12859)
 
@@ -13,10 +14,9 @@ SAML assertions get a full summary panel with binding type, message type, status
 
 Think [jwt.io](https://jwt.io), but for the full modern IAM stack — built by someone who actually works in identity, for everyone else who does too.
 
-
 ## Who is it for?
 
-[samlguy.com](https://samlguy.com) is built by an IAM practitioner, for the IAM practitioner community: identity architects and engineers at universities, research institutions, and other organizations participating in federated identity like **[InCommon](https://incommon.org)** and **[eduGAIN](https://edugain.org/)**, and the broader R&E Trust & Identity community. 
+[samlguy.com](https://samlguy.com) is built by an IAM practitioner, for the IAM practitioner community: identity architects and engineers at universities, research institutions, and other organizations participating in federated identity like **[InCommon](https://incommon.org)** and **[eduGAIN](https://edugain.org/)**, and the broader R&E Trust & Identity community.
 
 If you run a Shibboleth IdP, debug SAML flows for a living, or spend time staring at raw base64 blobs in Fiddler or a browser DevTools network tab — this tool belongs in your bookmarks.
 
@@ -34,14 +34,12 @@ But it's not just SAML! It's equally useful for OAuth 2.0 / OIDC work. Access to
 
 **Everything else** — contextual `?` tooltips on every field covering the SAML spec, JWT/OIDC standards, and trust fabric conventions. Shareable links base64url-encode the input into the URL fragment — never sent to the server. Dark mode default with `localStorage` persistence.
 
-
 ## Privacy & Security
 
 **All SAML and JWT payloads are decoded entirely in your browser.** Nothing you paste is ever transmitted to or stored on any server. The only network request the tool makes on your behalf is the OIDC discovery proxy described above, which receives only an issuer URL, not the token itself.
 
 See [SECURITY.md](SECURITY.md) for the full vulnerability disclosure policy and a description of the security controls in this project.
 
-
 ## Local development
 
 ```bash
@@ -63,7 +61,6 @@ npm run build       # production build
 npm run preview     # preview production build locally
 ```
 
-
 ## Project structure
 
 ```
@@ -96,12 +93,10 @@ src/
   CODEOWNERS
 ```
 
-
 ## Deployment
 
 [samlguy.com](https://samlguy.com) is deployed using Cloudflare Pages. Every merge to `main` triggers an automatic build and deploy via GitHub Actions — but only after the test and coverage jobs pass. Build command: `npm run build`, output directory: `.svelte-kit/cloudflare`.
 
-
 ## What's Planned
 
 - **Diff view** — paste two assertions side-by-side and highlight what changed; most useful for attribute table and timestamp diffs when debugging why a second login attempt looks different
@@ -111,12 +106,10 @@ src/
 - **JWT JWKS validation** — after OIDC discovery, fetch `jwks_uri` and verify the JWT signature against the matching key
 - **REFEDS entity category checker** — given an EntityID (via MDQ), check whether the IdP's attribute release policy would likely cover the SP's requested attributes; builds on the entity-category and requested-attribute parsing already in the metadata view
 
-
 ## Contributing
 
 This started as a personal passion project for [The SAML Guy](https://kellenmurphy.com) to mess with a nifty tech stack (Svelte). Bug reports and suggestions are welcome via [GitHub Issues](https://github.com/kellenmurphy/samlguy/issues). See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution guidelines. For security vulnerabilities, please follow the [responsible disclosure process](SECURITY.md) rather than opening a public issue.
 
-
 ## License
 
-[MIT](LICENSE) — free to use, modify, and distribute. Attribution appreciated but not required.
\ No newline at end of file
+[MIT](LICENSE) — free to use, modify, and distribute. Attribution appreciated but not required.
diff --git a/SECURITY.md b/SECURITY.md
index 757ac8c..c797f69 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -31,14 +31,14 @@ You can expect an acknowledgement within 48 hours and a resolution or status upd
 
 ### Adversaries and assets
 
-| Adversary | Goal | Primary controls |
-|---|---|---|
-| Malicious paste / shared link | Trigger XSS via crafted SAML or JWT content rendered in the DOM | Svelte's default text escaping, `esc()` in the XML highlighter, CSP (`default-src 'self'`, no `unsafe-inline`, hash-pinned inline scripts) |
-| Compromised npm package | Inject malicious code into the build or CI environment | GuardDog, `npm audit`, Grype, Dependency Review, SHA-pinned actions, `npm ci` lockfile enforcement |
-| Compromised upstream GitHub Action | Substitute malicious CI code via a tampered version tag | All actions pinned to commit SHA, Dependabot rotates pins daily |
-| SSRF via OIDC proxy | Use the discovery Worker to reach internal infrastructure | `redirect: 'error'`, 5-second timeout, 100 KB cap, response validation |
-| Compromised maintainer account | Push unsigned or unreviewed code to `main` | Required commit signatures, branch protection, CODEOWNERS review, scoped API tokens |
-| Information leakage | Exfiltrate SAML assertions or JWT payloads | All decoding is client-side; no server ever receives token content; Worker code logs nothing; `Referrer-Policy: no-referrer` prevents issuer URLs from leaking via outbound navigation |
+| Adversary                          | Goal                                                            | Primary controls                                                                                                                                                                       |
+| ---------------------------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Malicious paste / shared link      | Trigger XSS via crafted SAML or JWT content rendered in the DOM | Svelte's default text escaping, `esc()` in the XML highlighter, CSP (`default-src 'self'`, no `unsafe-inline`, hash-pinned inline scripts)                                             |
+| Compromised npm package            | Inject malicious code into the build or CI environment          | GuardDog, `npm audit`, Grype, Dependency Review, SHA-pinned actions, `npm ci` lockfile enforcement                                                                                     |
+| Compromised upstream GitHub Action | Substitute malicious CI code via a tampered version tag         | All actions pinned to commit SHA, Dependabot rotates pins daily                                                                                                                        |
+| SSRF via OIDC proxy                | Use the discovery Worker to reach internal infrastructure       | `redirect: 'error'`, 5-second timeout, 100 KB cap, response validation                                                                                                                 |
+| Compromised maintainer account     | Push unsigned or unreviewed code to `main`                      | Required commit signatures, branch protection, CODEOWNERS review, scoped API tokens                                                                                                    |
+| Information leakage                | Exfiltrate SAML assertions or JWT payloads                      | All decoding is client-side; no server ever receives token content; Worker code logs nothing; `Referrer-Policy: no-referrer` prevents issuer URLs from leaking via outbound navigation |
 
 ### Out of scope
 
@@ -130,6 +130,7 @@ The adapter additionally appends `Cache-Control: public, immutable, max-age=3153
 All GitHub Actions are pinned to a full commit SHA, not a mutable version tag. Version tags can be silently redirected by a compromised upstream repository, substituting malicious code into the pipeline. Pinning by SHA means the exact code reviewed at setup time is the code that runs. Human-readable version numbers are preserved as inline comments.
 
 Current pins in `.github/workflows/ci.yml`:
+
 - `actions/checkout` — SHA-pinned
 - `actions/setup-node` — SHA-pinned
 - `astral-sh/setup-uv` — SHA-pinned (v8.1.0)
@@ -142,15 +143,18 @@ Current pins in `.github/workflows/ci.yml`:
 - `actions/attest-build-provenance` — SHA-pinned (v4.1.0)
 
 Current pins in `.github/workflows/scorecard.yml`:
+
 - `actions/checkout` — SHA-pinned
 - `ossf/scorecard-action` — SHA-pinned (v2.4.3)
 - `actions/upload-artifact` — SHA-pinned (v7.0.1)
 - `github/codeql-action/upload-sarif` — SHA-pinned
 
 Current pins in `.github/workflows/release-please.yml`:
+
 - `googleapis/release-please-action` — SHA-pinned (v4)
 
 Current pins in `.github/workflows/codeql.yml`:
+
 - `actions/checkout` — SHA-pinned
 - `github/codeql-action/init` — SHA-pinned (v3.28.13)
 - `github/codeql-action/analyze` — SHA-pinned (v3.28.13)
@@ -186,6 +190,7 @@ GitHub secret scanning and push protection are both enabled on this repository.
 ### Dependabot
 
 Dependabot runs daily for:
+
 - **npm packages** — grouped (Svelte ecosystem together, Cloudflare tools together) to reduce PR noise while keeping everything current. Commits use the `chore(deps)` prefix so routine dependency bumps do not trigger unnecessary patch releases via release-please.
 - **GitHub Actions** — separate ecosystem entry, because action dependencies are a supply chain vector that is easy to neglect
 
@@ -215,7 +220,7 @@ Alongside the `Dependency Audit` job (push, weekly schedule, and manual dispatch
 
 ### Dependency Review
 
-The [dependency-review-action](https://github.com/actions/dependency-review-action) runs on pull requests only. It compares the dependency diff introduced by the PR against GitHub's vulnerability database and fails the check if any newly added package carries a moderate or higher CVE. This is the pull-request-time vulnerability gate: it catches vulnerable dependencies a PR would *introduce*, before they land in `main`, while the full-tree `npm audit` and Grype scans run on push and the weekly schedule. A PR is therefore never blocked by a pre-existing, tree-wide advisory in a dependency the PR did not touch.
+The [dependency-review-action](https://github.com/actions/dependency-review-action) runs on pull requests only. It compares the dependency diff introduced by the PR against GitHub's vulnerability database and fails the check if any newly added package carries a moderate or higher CVE. This is the pull-request-time vulnerability gate: it catches vulnerable dependencies a PR would _introduce_, before they land in `main`, while the full-tree `npm audit` and Grype scans run on push and the weekly schedule. A PR is therefore never blocked by a pre-existing, tree-wide advisory in a dependency the PR did not touch.
 
 ### GitHub Code Scanning
 
@@ -266,4 +271,3 @@ Since samlguy.com deploys continuously from `main`, the production deployment al
 ## License
 
 This project is released under the [MIT License](LICENSE). You are free to use, fork, modify, and distribute the code. The only requirement is that the copyright notice is preserved in copies or substantial portions of the software.
-
diff --git a/package-lock.json b/package-lock.json
index e30de62..ea59f5f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,30 +8,30 @@
             "name": "samlguy",
             "version": "1.5.2",
             "dependencies": {
-                "pako": "^2.2.0"
+                "pako": "^3.0.0"
             },
             "devDependencies": {
                 "@eslint/js": "^10.0.1",
                 "@sveltejs/adapter-cloudflare": "^7.2.9",
                 "@sveltejs/kit": "^2.68.0",
                 "@sveltejs/vite-plugin-svelte": "^7.1.2",
-                "@tailwindcss/vite": "^4.3.1",
+                "@tailwindcss/vite": "^4.3.2",
                 "@types/node": "^26.0.1",
                 "@types/pako": "^2.0.4",
                 "@vitest/coverage-v8": "^4.1.9",
-                "eslint": "^10.5.0",
-                "eslint-plugin-svelte": "^3.19.0",
+                "eslint": "^10.6.0",
+                "eslint-plugin-svelte": "^3.20.0",
                 "fast-check": "^4.8.0",
                 "globals": "^17.7.0",
                 "happy-dom": "^20.10.6",
                 "jsdom": "^29.1.1",
-                "prettier": "^3.8.4",
+                "prettier": "^3.9.3",
                 "prettier-plugin-svelte": "^4.1.1",
                 "svelte": "^5.56.4",
                 "svelte-check": "^4.7.1",
-                "tailwindcss": "^4.3.1",
+                "tailwindcss": "^4.3.2",
                 "typescript": "^6.0.3",
-                "typescript-eslint": "^8.62.0",
+                "typescript-eslint": "^8.62.1",
                 "vite": "^8.1.0",
                 "vitest": "^4.1.9",
                 "wrangler": "^4.105.0"
@@ -2204,9 +2204,9 @@
             }
         },
         "node_modules/@tailwindcss/node": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
-            "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.2.tgz",
+            "integrity": "sha512-yWP/sqEcBLaD8JuA6zNwxoYKr75qxTioYwlRwekj5Jr/I5GXnoJfjetH/psLUIv74cYTH2lBUEzBkinthoYcBg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -2216,37 +2216,37 @@
                 "lightningcss": "1.32.0",
                 "magic-string": "^0.30.21",
                 "source-map-js": "^1.2.1",
-                "tailwindcss": "4.3.1"
+                "tailwindcss": "4.3.2"
             }
         },
         "node_modules/@tailwindcss/oxide": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
-            "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.2.tgz",
+            "integrity": "sha512-z8ZgnzX8gdNoWLBLqBPoh/sjnxkwvf9ZuWjnO0l0yIzbLa5/9S+eC5QxGZKRobVHIC3/1BoMWjHblqWjcgFgag==",
             "dev": true,
             "license": "MIT",
             "engines": {
                 "node": ">= 20"
             },
             "optionalDependencies": {
-                "@tailwindcss/oxide-android-arm64": "4.3.1",
-                "@tailwindcss/oxide-darwin-arm64": "4.3.1",
-                "@tailwindcss/oxide-darwin-x64": "4.3.1",
-                "@tailwindcss/oxide-freebsd-x64": "4.3.1",
-                "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
-                "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
-                "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
-                "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
-                "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
-                "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
-                "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
-                "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+                "@tailwindcss/oxide-android-arm64": "4.3.2",
+                "@tailwindcss/oxide-darwin-arm64": "4.3.2",
+                "@tailwindcss/oxide-darwin-x64": "4.3.2",
+                "@tailwindcss/oxide-freebsd-x64": "4.3.2",
+                "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.2",
+                "@tailwindcss/oxide-linux-arm64-gnu": "4.3.2",
+                "@tailwindcss/oxide-linux-arm64-musl": "4.3.2",
+                "@tailwindcss/oxide-linux-x64-gnu": "4.3.2",
+                "@tailwindcss/oxide-linux-x64-musl": "4.3.2",
+                "@tailwindcss/oxide-wasm32-wasi": "4.3.2",
+                "@tailwindcss/oxide-win32-arm64-msvc": "4.3.2",
+                "@tailwindcss/oxide-win32-x64-msvc": "4.3.2"
             }
         },
         "node_modules/@tailwindcss/oxide-android-arm64": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
-            "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.2.tgz",
+            "integrity": "sha512-WHxqIuHpvZ5VtdX6GTl1Ik/Vp2YuN42Et+0CdeaVd/frQ9jAvGmvR8vLT+jk3e8/Q3x8kECB9+R17pgpp2BulA==",
             "cpu": [
                 "arm64"
             ],
@@ -2261,9 +2261,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-darwin-arm64": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
-            "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.2.tgz",
+            "integrity": "sha512-GZypeUY/IDJW3877KeM+O67vbXr3MBnbtEL4aYhNErv/JWZhye2vGSWWG9tB6iiqR2MqRNkY8IOUy4NdSZV26w==",
             "cpu": [
                 "arm64"
             ],
@@ -2278,9 +2278,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-darwin-x64": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
-            "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.2.tgz",
+            "integrity": "sha512-UIIzmefR6KO1sDU7MzRqAxC8iBpft/VhkGjTjnhoS6k7Z3rQ9wEgA1ODSiyH/tcSYssulNm4Ci3hOeK1jH7ccQ==",
             "cpu": [
                 "x64"
             ],
@@ -2295,9 +2295,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-freebsd-x64": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
-            "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.2.tgz",
+            "integrity": "sha512-GN+uAmcI6DNspnCDwtOAZrTz6oukJnp337qZvxqCGLd3BHBzJpO0ZbTLRvJNdztOeAmTzewewGIMPb0tk2R4WA==",
             "cpu": [
                 "x64"
             ],
@@ -2312,9 +2312,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
-            "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.2.tgz",
+            "integrity": "sha512-4ABn7qSbdHRwTiDiuWNegCyb5+2FJ4vKIKc3DmKrvAFw7MU1Lm11dIkTPwUaFdTzc7IsOpDbqBrlh0x6y36U/w==",
             "cpu": [
                 "arm"
             ],
@@ -2329,9 +2329,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
-            "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.2.tgz",
+            "integrity": "sha512-wDgEIGwoM8w8pufh9LVt1PahDgNdKXrLC2qfAnV3vAmococ9RWbxeAw4pxPttd/TsJfwjyLf90Dg1y9y8I6Emw==",
             "cpu": [
                 "arm64"
             ],
@@ -2349,9 +2349,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
-            "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.2.tgz",
+            "integrity": "sha512-J5Nuk0uZQIiMTJj3LEx4sAA9tMFUoXQZFv1J6An+QGYe53HKRJuFDi0rpq/tuouCZeAbOBY3kQ6g8qeD4TUjtA==",
             "cpu": [
                 "arm64"
             ],
@@ -2369,9 +2369,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
-            "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.2.tgz",
+            "integrity": "sha512-kqCZpSKOBEJO4mz7OqWoofBZeXTAwaVGPj0ErAj7CojmhKpWVWVOnrt9dE8odoIraZq4oj3ausM37kXi+Tow8w==",
             "cpu": [
                 "x64"
             ],
@@ -2389,9 +2389,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
-            "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.2.tgz",
+            "integrity": "sha512-cixpqbh2toJDmkuCRI68nXA8ZxNmdK9Y+9v5h3MC3ZQKy/0BO8AWzlkWyRM7JAFSGBlfig4YVTPsK6MVgqz1uw==",
             "cpu": [
                 "x64"
             ],
@@ -2409,9 +2409,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
-            "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.2.tgz",
+            "integrity": "sha512-4ec2Z/LOmRsAgU23CS4xeJfcJlmRg94A/XrbGRCF1gyU/zdDfRLYDVsS+ynSZCmGNxQ1jQriQOKMQeQxBA3Isw==",
             "bundleDependencies": [
                 "@napi-rs/wasm-runtime",
                 "@emnapi/core",
@@ -2427,9 +2427,9 @@
             "license": "MIT",
             "optional": true,
             "dependencies": {
-                "@emnapi/core": "^1.10.0",
-                "@emnapi/runtime": "^1.10.0",
-                "@emnapi/wasi-threads": "^1.2.1",
+                "@emnapi/core": "^1.11.1",
+                "@emnapi/runtime": "^1.11.1",
+                "@emnapi/wasi-threads": "^1.2.2",
                 "@napi-rs/wasm-runtime": "^1.1.4",
                 "@tybys/wasm-util": "^0.10.2",
                 "tslib": "^2.8.1"
@@ -2439,9 +2439,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
-            "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.2.tgz",
+            "integrity": "sha512-Zyr/M0+XcYZu3bZrUytc7TXvrk0ftWfl8gN2MwekNDzhqhKRUucMPSeOzM0o0wH5AWOU49BsKRrfKxI2atCPMQ==",
             "cpu": [
                 "arm64"
             ],
@@ -2456,9 +2456,9 @@
             }
         },
         "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
-            "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.2.tgz",
+            "integrity": "sha512-QI9BO7KlNZsp2GuO0jwAAj5jCDABOKXRkCk2XuKTSaNEFSdfzqswYVTtCHBNKHLsqyjFyFkqlDiwkNbTYSssMQ==",
             "cpu": [
                 "x64"
             ],
@@ -2473,15 +2473,15 @@
             }
         },
         "node_modules/@tailwindcss/vite": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.1.tgz",
-            "integrity": "sha512-hItDHuIIlEV61R+faXu66s1K36aTurO/Qw0e45Vskz57gXl9pWOT6eg3zmcEui6CZXddbN7zd41bwmvag4JGwQ==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.2.tgz",
+            "integrity": "sha512-eHpMeX4JXfVNJDEcsouTeCBubJBTcTLigeaw/NTUW6PB5ATKKXdyonnXgTBX2VuRbjz1hjfz6C5XAhr52ImQXA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@tailwindcss/node": "4.3.1",
-                "@tailwindcss/oxide": "4.3.1",
-                "tailwindcss": "4.3.1"
+                "@tailwindcss/node": "4.3.2",
+                "@tailwindcss/oxide": "4.3.2",
+                "tailwindcss": "4.3.2"
             },
             "peerDependencies": {
                 "vite": "^5.2.0 || ^6 || ^7 || ^8"
@@ -2586,17 +2586,17 @@
             }
         },
         "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.0.tgz",
-            "integrity": "sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.1.tgz",
+            "integrity": "sha512-4EQM77WgVNxj7OkL/5b/D/xZsw00G577+UriYTC7JF5opcF3T2AuoeY7ueLaZgSVjSgCS6yOAJB5bRGLPSJUzA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "@eslint-community/regexpp": "^4.12.2",
-                "@typescript-eslint/scope-manager": "8.62.0",
-                "@typescript-eslint/type-utils": "8.62.0",
-                "@typescript-eslint/utils": "8.62.0",
-                "@typescript-eslint/visitor-keys": "8.62.0",
+                "@typescript-eslint/scope-manager": "8.62.1",
+                "@typescript-eslint/type-utils": "8.62.1",
+                "@typescript-eslint/utils": "8.62.1",
+                "@typescript-eslint/visitor-keys": "8.62.1",
                 "ignore": "^7.0.5",
                 "natural-compare": "^1.4.0",
                 "ts-api-utils": "^2.5.0"
@@ -2609,7 +2609,7 @@
                 "url": "https://opencollective.com/typescript-eslint"
             },
             "peerDependencies": {
-                "@typescript-eslint/parser": "^8.62.0",
+                "@typescript-eslint/parser": "^8.62.1",
                 "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
                 "typescript": ">=4.8.4 <6.1.0"
             }
@@ -2625,16 +2625,16 @@
             }
         },
         "node_modules/@typescript-eslint/parser": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.0.tgz",
-            "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.1.tgz",
+            "integrity": "sha512-sPhE4iHuJDSvoAiec+Ro8JyXw8f0ql13HFR82P99nCm9GwTEKG0KYLvDe6REk8BCXuit6vJAv/Yxg5ABaNS2rA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/scope-manager": "8.62.0",
-                "@typescript-eslint/types": "8.62.0",
-                "@typescript-eslint/typescript-estree": "8.62.0",
-                "@typescript-eslint/visitor-keys": "8.62.0",
+                "@typescript-eslint/scope-manager": "8.62.1",
+                "@typescript-eslint/types": "8.62.1",
+                "@typescript-eslint/typescript-estree": "8.62.1",
+                "@typescript-eslint/visitor-keys": "8.62.1",
                 "debug": "^4.4.3"
             },
             "engines": {
@@ -2650,14 +2650,14 @@
             }
         },
         "node_modules/@typescript-eslint/project-service": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.0.tgz",
-            "integrity": "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.1.tgz",
+            "integrity": "sha512-yQ3RgY5RkSBpsNS1Bx/JQEcA24FOSdfGktoyprAr5u18390UQdtVcfnEv4nIrIshNnavlVyZBKxQwT1fIAE6cg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/tsconfig-utils": "^8.62.0",
-                "@typescript-eslint/types": "^8.62.0",
+                "@typescript-eslint/tsconfig-utils": "^8.62.1",
+                "@typescript-eslint/types": "^8.62.1",
                 "debug": "^4.4.3"
             },
             "engines": {
@@ -2672,14 +2672,14 @@
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz",
-            "integrity": "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.1.tgz",
+            "integrity": "sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.62.0",
-                "@typescript-eslint/visitor-keys": "8.62.0"
+                "@typescript-eslint/types": "8.62.1",
+                "@typescript-eslint/visitor-keys": "8.62.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2690,9 +2690,9 @@
             }
         },
         "node_modules/@typescript-eslint/tsconfig-utils": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz",
-            "integrity": "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.1.tgz",
+            "integrity": "sha512-xadytJqX9vJVQ2fdQjkcIVigwaOJNWkpjdLt6cEQ+xPnrI1fkp+/jZE/I97k9KUjqtpd25i0HeyZf3T6dutv2g==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -2707,15 +2707,15 @@
             }
         },
         "node_modules/@typescript-eslint/type-utils": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.0.tgz",
-            "integrity": "sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.1.tgz",
+            "integrity": "sha512-aXM5xlqXiTxPibXB93cLAURfT3rlizf7uMXISCXy66Isr/9hISJx3yDsKl0L7lKa51b8JpFuNKby0/O0pEm9jg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.62.0",
-                "@typescript-eslint/typescript-estree": "8.62.0",
-                "@typescript-eslint/utils": "8.62.0",
+                "@typescript-eslint/types": "8.62.1",
+                "@typescript-eslint/typescript-estree": "8.62.1",
+                "@typescript-eslint/utils": "8.62.1",
                 "debug": "^4.4.3",
                 "ts-api-utils": "^2.5.0"
             },
@@ -2732,9 +2732,9 @@
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.0.tgz",
-            "integrity": "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.1.tgz",
+            "integrity": "sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -2746,16 +2746,16 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz",
-            "integrity": "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.1.tgz",
+            "integrity": "sha512-xMcW9oP9u7fAMXYs9A65CVmtLQe2r//oXINHfi8HV+oiqhih17sbLdhXr4540YWlgpDKQdY854OL5ZrdCiQsAA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/project-service": "8.62.0",
-                "@typescript-eslint/tsconfig-utils": "8.62.0",
-                "@typescript-eslint/types": "8.62.0",
-                "@typescript-eslint/visitor-keys": "8.62.0",
+                "@typescript-eslint/project-service": "8.62.1",
+                "@typescript-eslint/tsconfig-utils": "8.62.1",
+                "@typescript-eslint/types": "8.62.1",
+                "@typescript-eslint/visitor-keys": "8.62.1",
                 "debug": "^4.4.3",
                 "minimatch": "^10.2.2",
                 "semver": "^7.7.3",
@@ -2774,16 +2774,16 @@
             }
         },
         "node_modules/@typescript-eslint/utils": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.0.tgz",
-            "integrity": "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.1.tgz",
+            "integrity": "sha512-sHtbPfuKNZCG+ih8SyjjucqRntSVmp8XgL5u6o9mAhiSn8ds5o/M/XdM0abweme2Tln3szOstOrZ9OXitvPh0g==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "@eslint-community/eslint-utils": "^4.9.1",
-                "@typescript-eslint/scope-manager": "8.62.0",
-                "@typescript-eslint/types": "8.62.0",
-                "@typescript-eslint/typescript-estree": "8.62.0"
+                "@typescript-eslint/scope-manager": "8.62.1",
+                "@typescript-eslint/types": "8.62.1",
+                "@typescript-eslint/typescript-estree": "8.62.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2798,13 +2798,13 @@
             }
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz",
-            "integrity": "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.1.tgz",
+            "integrity": "sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.62.0",
+                "@typescript-eslint/types": "8.62.1",
                 "eslint-visitor-keys": "^5.0.0"
             },
             "engines": {
@@ -3372,9 +3372,9 @@
             }
         },
         "node_modules/eslint": {
-            "version": "10.5.0",
-            "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.5.0.tgz",
-            "integrity": "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ==",
+            "version": "10.6.0",
+            "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.6.0.tgz",
+            "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
             "dev": true,
             "license": "MIT",
             "workspaces": [
@@ -3431,9 +3431,9 @@
             }
         },
         "node_modules/eslint-plugin-svelte": {
-            "version": "3.19.0",
-            "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.19.0.tgz",
-            "integrity": "sha512-t3rNaZeXz4d2gG4uJyMEYfJCFKf22+SWbSizIIXIWKu4wM+XPLiMWuSSr/C5821JmFeN9ogK+eExbG+z+twyxw==",
+            "version": "3.20.0",
+            "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.20.0.tgz",
+            "integrity": "sha512-AElKLVt7Hjy4d7ljwhrhw9hux60DCxCNkmK8cY/aAXvjs8tpR7PvU4DlyI/SA1PaJww1gh0wPGo2pbyURuEwxQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -4565,9 +4565,9 @@
             }
         },
         "node_modules/pako": {
-            "version": "2.2.0",
-            "resolved": "https://registry.npmjs.org/pako/-/pako-2.2.0.tgz",
-            "integrity": "sha512-zJq6RP/5q+TO2OpFV3FHzlPnFjmkb7Nc99a5SNjJE+uu/PkpChs+NIZSSzbBoD+6kjiISXjfYdwj1ZRQ81dz/w==",
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/pako/-/pako-3.0.0.tgz",
+            "integrity": "sha512-TGPtlCI1pSUSbkOIxOUUHNrBa0muz4mAp32cYUF3RoSa5c73jiQTKOKo22gaa4DxLggQrda/DAdax5QkcHPvYA==",
             "funding": [
                 {
                     "type": "github",
@@ -4808,9 +4808,9 @@
             }
         },
         "node_modules/prettier": {
-            "version": "3.8.4",
-            "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
-            "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
+            "version": "3.9.4",
+            "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz",
+            "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==",
             "dev": true,
             "license": "MIT",
             "bin": {
@@ -5245,9 +5245,9 @@
             "license": "MIT"
         },
         "node_modules/tailwindcss": {
-            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
-            "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.2.tgz",
+            "integrity": "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==",
             "dev": true,
             "license": "MIT"
         },
@@ -5414,16 +5414,16 @@
             }
         },
         "node_modules/typescript-eslint": {
-            "version": "8.62.0",
-            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.0.tgz",
-            "integrity": "sha512-8QxXi+ZACKX0kaqO4gY8kn0RSD9gFfaHDWwjqtEN48aWCBkX4MJaufWN+c3BzlrXLOxfywDL8CaoqUwcRq4j4Q==",
+            "version": "8.62.1",
+            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.1.tgz",
+            "integrity": "sha512-vymnnM5g0AKQDSAyfP12nMIBvgwgA42syg74kkuZ4x1VuTzwQKwc5h9rGxeShCjny5o+zWAb6OEoz7XLgrIkIw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/eslint-plugin": "8.62.0",
-                "@typescript-eslint/parser": "8.62.0",
-                "@typescript-eslint/typescript-estree": "8.62.0",
-                "@typescript-eslint/utils": "8.62.0"
+                "@typescript-eslint/eslint-plugin": "8.62.1",
+                "@typescript-eslint/parser": "8.62.1",
+                "@typescript-eslint/typescript-estree": "8.62.1",
+                "@typescript-eslint/utils": "8.62.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
diff --git a/package.json b/package.json
index 4008472..a5cdb51 100644
--- a/package.json
+++ b/package.json
@@ -20,29 +20,29 @@
         "@sveltejs/adapter-cloudflare": "^7.2.9",
         "@sveltejs/kit": "^2.68.0",
         "@sveltejs/vite-plugin-svelte": "^7.1.2",
-        "@tailwindcss/vite": "^4.3.1",
+        "@tailwindcss/vite": "^4.3.2",
         "@types/node": "^26.0.1",
         "@types/pako": "^2.0.4",
         "@vitest/coverage-v8": "^4.1.9",
-        "eslint": "^10.5.0",
-        "eslint-plugin-svelte": "^3.19.0",
+        "eslint": "^10.6.0",
+        "eslint-plugin-svelte": "^3.20.0",
         "fast-check": "^4.8.0",
         "globals": "^17.7.0",
         "happy-dom": "^20.10.6",
         "jsdom": "^29.1.1",
-        "prettier": "^3.8.4",
+        "prettier": "^3.9.3",
         "prettier-plugin-svelte": "^4.1.1",
         "svelte": "^5.56.4",
         "svelte-check": "^4.7.1",
-        "tailwindcss": "^4.3.1",
+        "tailwindcss": "^4.3.2",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.62.0",
+        "typescript-eslint": "^8.62.1",
         "vite": "^8.1.0",
         "vitest": "^4.1.9",
         "wrangler": "^4.105.0"
     },
     "dependencies": {
-        "pako": "^2.2.0"
+        "pako": "^3.0.0"
     },
     "overrides": {
         "cookie": "^0.7.0",
diff --git a/src/lib/InfoTip.svelte b/src/lib/InfoTip.svelte
index e057924..cae1866 100644
--- a/src/lib/InfoTip.svelte
+++ b/src/lib/InfoTip.svelte
@@ -29,8 +29,8 @@
         onmouseenter={show}
         onfocus={show}
         onmouseleave={hide}
-        onblur={hide}
-    >?</button>
+        onblur={hide}>?</button
+    >
     {#if visible}
         <div
             role="tooltip"
diff --git a/src/lib/attributes.test.ts b/src/lib/attributes.test.ts
index 8d26df2..741a92c 100644
--- a/src/lib/attributes.test.ts
+++ b/src/lib/attributes.test.ts
@@ -1,10 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import {
-    getAttributeInfo,
-    eppnScopedStatus,
-    EPPN_OID,
-    ATTRIBUTE_REGISTRY,
-} from './attributes';
+import { getAttributeInfo, eppnScopedStatus, EPPN_OID, ATTRIBUTE_REGISTRY } from './attributes';
 
 describe('ATTRIBUTE_REGISTRY', () => {
     it('EPPN_OID constant matches the registry entry', () => {
diff --git a/src/lib/attributes.ts b/src/lib/attributes.ts
index 4d848c8..c54f366 100644
--- a/src/lib/attributes.ts
+++ b/src/lib/attributes.ts
@@ -9,45 +9,60 @@ export const EPPN_OID = 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6';
 
 export const ATTRIBUTE_REGISTRY: Record<string, AttributeInfo> = {
     // ── eduPerson ─────────────────────────────────────────────────────────────────
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.1':  { friendlyName: 'eduPersonAffiliation',        categories: [] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.2':  { friendlyName: 'eduPersonNickname',           categories: [] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.5':  { friendlyName: 'eduPersonPrimaryAffiliation', categories: [] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.6':  { friendlyName: 'eduPersonPrincipalName',      categories: ['rs'] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.7':  { friendlyName: 'eduPersonEntitlement',        categories: [] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.9':  { friendlyName: 'eduPersonScopedAffiliation',  categories: ['rs'] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.10': { friendlyName: 'eduPersonTargetedID',         categories: ['rs'] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.11': { friendlyName: 'eduPersonAssurance',          categories: [] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.12': { friendlyName: 'eduPersonUniqueId',           categories: ['rs'] },
-    'urn:oid:1.3.6.1.4.1.5923.1.1.1.13': { friendlyName: 'eduPersonOrcid',              categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.1': { friendlyName: 'eduPersonAffiliation', categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.2': { friendlyName: 'eduPersonNickname', categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.5': {
+        friendlyName: 'eduPersonPrimaryAffiliation',
+        categories: []
+    },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.6': {
+        friendlyName: 'eduPersonPrincipalName',
+        categories: ['rs']
+    },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.7': { friendlyName: 'eduPersonEntitlement', categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.9': {
+        friendlyName: 'eduPersonScopedAffiliation',
+        categories: ['rs']
+    },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.10': {
+        friendlyName: 'eduPersonTargetedID',
+        categories: ['rs']
+    },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.11': { friendlyName: 'eduPersonAssurance', categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.12': { friendlyName: 'eduPersonUniqueId', categories: ['rs'] },
+    'urn:oid:1.3.6.1.4.1.5923.1.1.1.13': { friendlyName: 'eduPersonOrcid', categories: [] },
     // ── inetOrgPerson / person ────────────────────────────────────────────────────
-    'urn:oid:0.9.2342.19200300.100.1.1':  { friendlyName: 'uid',               categories: [] },
-    'urn:oid:0.9.2342.19200300.100.1.3':  { friendlyName: 'mail',              categories: ['rs'] },
-    'urn:oid:0.9.2342.19200300.100.1.37': { friendlyName: 'labeledUri',        categories: [] },
-    'urn:oid:0.9.2342.19200300.100.1.41': { friendlyName: 'mobile',            categories: [] },
-    'urn:oid:2.5.4.3':                    { friendlyName: 'cn',                categories: [] },
-    'urn:oid:2.5.4.4':                    { friendlyName: 'sn',                categories: ['rs'] },
-    'urn:oid:2.5.4.6':                    { friendlyName: 'c',                 categories: [] },
-    'urn:oid:2.5.4.7':                    { friendlyName: 'l',                 categories: [] },
-    'urn:oid:2.5.4.8':                    { friendlyName: 'st',                categories: [] },
-    'urn:oid:2.5.4.9':                    { friendlyName: 'street',            categories: [] },
-    'urn:oid:2.5.4.10':                   { friendlyName: 'o',                 categories: [] },
-    'urn:oid:2.5.4.11':                   { friendlyName: 'ou',                categories: [] },
-    'urn:oid:2.5.4.12':                   { friendlyName: 'title',             categories: [] },
-    'urn:oid:2.5.4.17':                   { friendlyName: 'postalCode',        categories: [] },
-    'urn:oid:2.5.4.20':                   { friendlyName: 'telephoneNumber',   categories: [] },
-    'urn:oid:2.5.4.42':                   { friendlyName: 'givenName',         categories: ['rs'] },
-    'urn:oid:2.16.840.1.113730.3.1.2':    { friendlyName: 'employeeType',      categories: [] },
-    'urn:oid:2.16.840.1.113730.3.1.3':    { friendlyName: 'employeeNumber',    categories: [] },
-    'urn:oid:2.16.840.1.113730.3.1.4':    { friendlyName: 'departmentNumber',  categories: [] },
-    'urn:oid:2.16.840.1.113730.3.1.39':   { friendlyName: 'preferredLanguage', categories: [] },
-    'urn:oid:2.16.840.1.113730.3.1.241':  { friendlyName: 'displayName',       categories: ['rs'] },
+    'urn:oid:0.9.2342.19200300.100.1.1': { friendlyName: 'uid', categories: [] },
+    'urn:oid:0.9.2342.19200300.100.1.3': { friendlyName: 'mail', categories: ['rs'] },
+    'urn:oid:0.9.2342.19200300.100.1.37': { friendlyName: 'labeledUri', categories: [] },
+    'urn:oid:0.9.2342.19200300.100.1.41': { friendlyName: 'mobile', categories: [] },
+    'urn:oid:2.5.4.3': { friendlyName: 'cn', categories: [] },
+    'urn:oid:2.5.4.4': { friendlyName: 'sn', categories: ['rs'] },
+    'urn:oid:2.5.4.6': { friendlyName: 'c', categories: [] },
+    'urn:oid:2.5.4.7': { friendlyName: 'l', categories: [] },
+    'urn:oid:2.5.4.8': { friendlyName: 'st', categories: [] },
+    'urn:oid:2.5.4.9': { friendlyName: 'street', categories: [] },
+    'urn:oid:2.5.4.10': { friendlyName: 'o', categories: [] },
+    'urn:oid:2.5.4.11': { friendlyName: 'ou', categories: [] },
+    'urn:oid:2.5.4.12': { friendlyName: 'title', categories: [] },
+    'urn:oid:2.5.4.17': { friendlyName: 'postalCode', categories: [] },
+    'urn:oid:2.5.4.20': { friendlyName: 'telephoneNumber', categories: [] },
+    'urn:oid:2.5.4.42': { friendlyName: 'givenName', categories: ['rs'] },
+    'urn:oid:2.16.840.1.113730.3.1.2': { friendlyName: 'employeeType', categories: [] },
+    'urn:oid:2.16.840.1.113730.3.1.3': { friendlyName: 'employeeNumber', categories: [] },
+    'urn:oid:2.16.840.1.113730.3.1.4': { friendlyName: 'departmentNumber', categories: [] },
+    'urn:oid:2.16.840.1.113730.3.1.39': { friendlyName: 'preferredLanguage', categories: [] },
+    'urn:oid:2.16.840.1.113730.3.1.241': { friendlyName: 'displayName', categories: ['rs'] },
     // ── SCHAC ─────────────────────────────────────────────────────────────────────
-    'urn:oid:1.3.6.1.4.1.25178.1.2.9':   { friendlyName: 'schacHomeOrganization',     categories: [] },
-    'urn:oid:1.3.6.1.4.1.25178.1.2.10':  { friendlyName: 'schacHomeOrganizationType', categories: [] },
-    'urn:oid:1.3.6.1.4.1.25178.1.2.14':  { friendlyName: 'schacPersonalUniqueCode',   categories: [] },
-    'urn:oid:1.3.6.1.4.1.25178.1.2.15':  { friendlyName: 'schacPersonalUniqueID',     categories: [] },
+    'urn:oid:1.3.6.1.4.1.25178.1.2.9': { friendlyName: 'schacHomeOrganization', categories: [] },
+    'urn:oid:1.3.6.1.4.1.25178.1.2.10': {
+        friendlyName: 'schacHomeOrganizationType',
+        categories: []
+    },
+    'urn:oid:1.3.6.1.4.1.25178.1.2.14': { friendlyName: 'schacPersonalUniqueCode', categories: [] },
+    'urn:oid:1.3.6.1.4.1.25178.1.2.15': { friendlyName: 'schacPersonalUniqueID', categories: [] },
     // ── Grouper / isMemberOf ──────────────────────────────────────────────────────
-    'urn:oid:1.3.6.1.4.1.5923.1.5.1.1':  { friendlyName: 'isMemberOf', categories: [] },
+    'urn:oid:1.3.6.1.4.1.5923.1.5.1.1': { friendlyName: 'isMemberOf', categories: [] }
 };
 
 export function getAttributeInfo(name: string): AttributeInfo | undefined {
diff --git a/src/lib/cert.test.ts b/src/lib/cert.test.ts
index f3b7235..af4cd48 100644
--- a/src/lib/cert.test.ts
+++ b/src/lib/cert.test.ts
@@ -1,6 +1,17 @@
 import { describe, it, expect } from 'vitest';
 import { decodeCert } from './cert';
-import { TEST_CERT_B64, EC_CERT_B64, GENTIME_CERT_B64, ED25519_CERT_B64, BIGSERIAL_CERT_B64, RSA_FALLBACK_CERT_B64, UTCTIME_OLD_CERT_B64, EC_NO_CURVE_CERT_B64, RSA_NO_ZERO_CERT_B64, TITLE_ATTR_CERT_B64 } from './fixtures.test-helper';
+import {
+    TEST_CERT_B64,
+    EC_CERT_B64,
+    GENTIME_CERT_B64,
+    ED25519_CERT_B64,
+    BIGSERIAL_CERT_B64,
+    RSA_FALLBACK_CERT_B64,
+    UTCTIME_OLD_CERT_B64,
+    EC_NO_CURVE_CERT_B64,
+    RSA_NO_ZERO_CERT_B64,
+    TITLE_ATTR_CERT_B64
+} from './fixtures.test-helper';
 
 describe('decodeCert', () => {
     const cert = decodeCert(TEST_CERT_B64);
diff --git a/src/lib/cert.ts b/src/lib/cert.ts
index 16fbecf..01467aa 100644
--- a/src/lib/cert.ts
+++ b/src/lib/cert.ts
@@ -68,8 +68,10 @@ function oid(bytes: Uint8Array): string {
     for (const b of bytes) {
         acc = (acc << 7) | (b & 0x7f);
         if (!(b & 0x80)) {
-            if (first) { parts.push(Math.floor(acc / 40), acc % 40); first = false; }
-            else parts.push(acc);
+            if (first) {
+                parts.push(Math.floor(acc / 40), acc % 40);
+                first = false;
+            } else parts.push(acc);
             acc = 0;
         }
     }
@@ -86,12 +88,12 @@ function parseTime(node: DerNode): Date {
         const y = parseInt(s.slice(0, 2));
         return new Date(
             `${y >= 50 ? 1900 + y : 2000 + y}-${s.slice(2, 4)}-${s.slice(4, 6)}` +
-            `T${s.slice(6, 8)}:${s.slice(8, 10)}:${s.slice(10, 12)}Z`
+                `T${s.slice(6, 8)}:${s.slice(8, 10)}:${s.slice(10, 12)}Z`
         );
     }
     return new Date(
         `${s.slice(0, 4)}-${s.slice(4, 6)}-${s.slice(6, 8)}` +
-        `T${s.slice(8, 10)}:${s.slice(10, 12)}:${s.slice(12, 14)}Z`
+            `T${s.slice(8, 10)}:${s.slice(10, 12)}:${s.slice(12, 14)}Z`
     );
 }
 
@@ -172,5 +174,13 @@ export function decodeCert(base64Der: string): CertInfo {
     const keyAlgorithm = parseKeyAlg(f[i]);
 
     const now = new Date();
-    return { subject, issuer, validFrom, validTo, isValid: now >= validFrom && now <= validTo, serialNumber, keyAlgorithm };
+    return {
+        subject,
+        issuer,
+        validFrom,
+        validTo,
+        isValid: now >= validFrom && now <= validTo,
+        serialNumber,
+        keyAlgorithm
+    };
 }
diff --git a/src/lib/examples.test.ts b/src/lib/examples.test.ts
index ee57db8..06d311d 100644
--- a/src/lib/examples.test.ts
+++ b/src/lib/examples.test.ts
@@ -106,9 +106,7 @@ describe('EXAMPLES', () => {
     });
 
     it('MFA SAMLResponse has REFEDS MFA authn context', () => {
-        const mfa = EXAMPLES.find(
-            (e) => e.category === 'SAMLResponse' && e.label.includes('MFA')
-        );
+        const mfa = EXAMPLES.find((e) => e.category === 'SAMLResponse' && e.label.includes('MFA'));
         expect(mfa).toBeDefined();
         expect(decodeSaml(mfa!.payload()).summary.authnContext?.classRef).toBe(
             'https://refeds.org/profile/mfa'
@@ -116,9 +114,7 @@ describe('EXAMPLES', () => {
     });
 
     it('MFA SAMLRequest has REFEDS MFA requested authn context', () => {
-        const mfa = EXAMPLES.find(
-            (e) => e.category === 'SAMLRequest' && e.label.includes('MFA')
-        );
+        const mfa = EXAMPLES.find((e) => e.category === 'SAMLRequest' && e.label.includes('MFA'));
         expect(mfa).toBeDefined();
         const result = decodeSaml(mfa!.payload());
         expect(result.summary.requestedAuthnContext?.classRefs).toContain(
diff --git a/src/lib/examples.ts b/src/lib/examples.ts
index 0cc40fc..3307424 100644
--- a/src/lib/examples.ts
+++ b/src/lib/examples.ts
@@ -22,7 +22,7 @@ export const EXAMPLE_CATEGORIES: ExampleCategory[] = [
     'JWT',
     'Authorization header',
     'Query string',
-    'Full URL',
+    'Full URL'
 ];
 
 function ts(offsetSeconds: number): string {
@@ -40,10 +40,7 @@ function encodeRedirectBinding(xml: string): string {
 }
 
 function b64url(obj: object): string {
-    return btoa(JSON.stringify(obj))
-        .replace(/=/g, '')
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_');
+    return btoa(JSON.stringify(obj)).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 
 function makeJwt(header: object, payload: object): string {
@@ -160,7 +157,7 @@ function idTokenPayload(): object {
         amr: ['pwd', 'mfa'],
         name: 'Jane Smith',
         email: 'jsmith@university.edu',
-        preferred_username: 'jsmith',
+        preferred_username: 'jsmith'
     };
 }
 
@@ -174,7 +171,7 @@ function accessTokenPayload(): object {
         exp: now + 3585,
         jti: 'jwt_6f84bc2a9d1e3057',
         scope: 'openid email profile',
-        client_id: 'app_xyz789',
+        client_id: 'app_xyz789'
     };
 }
 
@@ -281,60 +278,59 @@ export const EXAMPLES: Example[] = [
     {
         label: 'Successful response (password auth)',
         category: 'SAMLResponse',
-        payload: () => samlResponse(),
+        payload: () => samlResponse()
     },
     {
         label: 'Successful response (REFEDS MFA)',
         category: 'SAMLResponse',
-        payload: () => samlResponse({ mfa: true }),
+        payload: () => samlResponse({ mfa: true })
     },
     {
         label: 'Basic authentication request',
         category: 'SAMLRequest',
-        payload: () => samlRequest(),
+        payload: () => samlRequest()
     },
     {
         label: 'Request requiring REFEDS MFA',
         category: 'SAMLRequest',
-        payload: () => samlRequest({ mfa: true }),
+        payload: () => samlRequest({ mfa: true })
     },
     {
         label: 'IdP metadata (Shibboleth)',
         category: 'Metadata',
-        payload: () => idpMetadata(),
+        payload: () => idpMetadata()
     },
     {
         label: 'SP metadata (Shibboleth)',
         category: 'Metadata',
-        payload: () => spMetadata(),
+        payload: () => spMetadata()
     },
     {
         label: 'OIDC ID token',
         category: 'JWT',
-        payload: () => makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'JWT' }, idTokenPayload()),
+        payload: () => makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'JWT' }, idTokenPayload())
     },
     {
         label: 'OAuth 2.0 access token',
         category: 'JWT',
         payload: () =>
-            makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'at+JWT' }, accessTokenPayload()),
+            makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'at+JWT' }, accessTokenPayload())
     },
     {
         label: 'Bearer token',
         category: 'Authorization header',
         payload: () =>
-            `Authorization: Bearer ${makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'JWT' }, idTokenPayload())}`,
+            `Authorization: Bearer ${makeJwt({ alg: 'RS256', kid: 'sig-2024-01', typ: 'JWT' }, idTokenPayload())}`
     },
     {
         label: 'Redirect binding query string',
         category: 'Query string',
-        payload: () =>
-            `SAMLRequest=${encodeRedirectBinding(samlRequest())}&RelayState=%2Fdashboard`,
+        payload: () => `SAMLRequest=${encodeRedirectBinding(samlRequest())}&RelayState=%2Fdashboard`
     },
     {
         label: 'IdP redirect binding URL',
         category: 'Full URL',
         payload: () =>
-            `https://idp.university.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=${encodeRedirectBinding(samlRequest())}&RelayState=%2Fdashboard`,
-    },
+            `https://idp.university.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=${encodeRedirectBinding(samlRequest())}&RelayState=%2Fdashboard`
+    }
 ];
diff --git a/src/lib/explanations.test.ts b/src/lib/explanations.test.ts
index 0b2b1f9..fb80c07 100644
--- a/src/lib/explanations.test.ts
+++ b/src/lib/explanations.test.ts
@@ -48,7 +48,7 @@ const EXPECTED_KEYS = [
     'jwt.scopes',
     'jwt.ts.issuedAt',
     'jwt.ts.notBefore',
-    'jwt.ts.expires',
+    'jwt.ts.expires'
 ];
 
 describe('FIELD_EXPLANATIONS', () => {
@@ -61,7 +61,10 @@ describe('FIELD_EXPLANATIONS', () => {
 describe('SAML_TS_KEY', () => {
     it('maps all SAML timestamp labels to known FIELD_EXPLANATIONS keys', () => {
         for (const [label, key] of Object.entries(SAML_TS_KEY)) {
-            expect(FIELD_EXPLANATIONS[key], `SAML_TS_KEY["${label}"] points to missing key "${key}"`).toBeDefined();
+            expect(
+                FIELD_EXPLANATIONS[key],
+                `SAML_TS_KEY["${label}"] points to missing key "${key}"`
+            ).toBeDefined();
         }
     });
 });
diff --git a/src/lib/explanations.ts b/src/lib/explanations.ts
index 941c8ed..00a399b 100644
--- a/src/lib/explanations.ts
+++ b/src/lib/explanations.ts
@@ -10,13 +10,13 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'The outcome of the SAML exchange. Success means the IdP authenticated the user and issued a valid assertion. Error responses carry a top-level code (Requester for SP-side problems, Responder for IdP-side) and usually a more specific sub-code.',
 
     'saml.issuer':
-        'The EntityID of the party that issued this message — the IdP for a Response, the SP for a Request. Must match the EntityID in the issuer\'s SAML metadata. A mismatch indicates misconfiguration or a spoofing attempt.',
+        "The EntityID of the party that issued this message — the IdP for a Response, the SP for a Request. Must match the EntityID in the issuer's SAML metadata. A mismatch indicates misconfiguration or a spoofing attempt.",
 
     'saml.destination':
         'The URL this message was addressed to. SAML requires recipients to verify that Destination matches their own endpoint URL. This check prevents message forwarding attacks, where a captured message is replayed at a different service.',
 
     'saml.acsUrl':
-        'Assertion Consumer Service URL — the SP endpoint where the IdP will POST the SAMLResponse. The IdP must validate this against the SP\'s registered metadata and must reject any ACS URL not listed there.',
+        "Assertion Consumer Service URL — the SP endpoint where the IdP will POST the SAMLResponse. The IdP must validate this against the SP's registered metadata and must reject any ACS URL not listed there.",
 
     'saml.nameId':
         'The identifier for the authenticated user. The Format attribute defines the type: emailAddress (user@domain), persistent (opaque but stable per SP — used for account linking), transient (changes each session — provides anonymity), or unspecified.',
@@ -28,10 +28,10 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'An opaque value the SP includes in the AuthnRequest and expects returned unchanged in the Response. Typically encodes the deep-link URL the user was trying to reach so the SP can redirect there after successful login.',
 
     'saml.encrypted':
-        'Whether the Assertion or NameID has been XML-encrypted. Requires the IdP to have the SP\'s public key from metadata. Protects sensitive attributes and user identifiers from intermediaries who can observe transport-level traffic.',
+        "Whether the Assertion or NameID has been XML-encrypted. Requires the IdP to have the SP's public key from metadata. Protects sensitive attributes and user identifiers from intermediaries who can observe transport-level traffic.",
 
     'saml.signingCert':
-        'The X.509 certificate whose private key signed this message. The relying party should verify the signature using the public key from the issuer\'s SAML metadata. An expired or unknown certificate outside a trusted metadata feed is a security concern.',
+        "The X.509 certificate whose private key signed this message. The relying party should verify the signature using the public key from the issuer's SAML metadata. An expired or unknown certificate outside a trusted metadata feed is a security concern.",
 
     'saml.authnContext':
         'The Authentication Context Class Reference — a URI that describes how the user authenticated at the IdP. Common values: Password (HTTPS) means username/password over TLS; Kerberos means a Kerberos ticket was used; REFEDS MFA means the session satisfies the REFEDS Multi-Factor Authentication profile, widely used in research and education federations.',
@@ -40,14 +40,14 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'The SP\'s requirements for how the user must authenticate. The Comparison attribute controls matching: "exact" requires one of the listed classes precisely; "minimum" accepts any class at least as strong; "better" requires strictly stronger; "maximum" requires no stronger. If the IdP cannot satisfy the requirement, it returns NoAuthnContext.',
 
     'saml.attributes':
-        'Attribute statements contain claims about the authenticated user released by the IdP — such as email, display name, group memberships, or entitlements. Which attributes are released is governed by IdP policy and the SP\'s metadata. These values typically drive authorization decisions at the SP. Badges: R&S = part of the REFEDS Research & Scholarship attribute bundle (applies to IdPs and SPs that have registered the R&S entity category in their metadata); eppn-scoped = eduPersonPrincipalName value is properly scoped (user@scope) per REFEDS RAF eppn-unique requirements.',
+        "Attribute statements contain claims about the authenticated user released by the IdP — such as email, display name, group memberships, or entitlements. Which attributes are released is governed by IdP policy and the SP's metadata. These values typically drive authorization decisions at the SP. Badges: R&S = part of the REFEDS Research & Scholarship attribute bundle (applies to IdPs and SPs that have registered the R&S entity category in their metadata); eppn-scoped = eduPersonPrincipalName value is properly scoped (user@scope) per REFEDS RAF eppn-unique requirements.",
 
     // ── SAML timestamps ───────────────────────────────────────────────────────
     'saml.ts.authnInstant':
         'When the user last authenticated at the IdP. If this is well in the past, the IdP is reusing an existing SSO session rather than prompting for fresh credentials — relevant when ForceAuthn or a maximum session age policy applies.',
 
     'saml.ts.sessionNotOnOrAfter':
-        'The IdP SSO session expiry. After this time the user must re-authenticate at the IdP. Distinct from the assertion\'s NotOnOrAfter — the session lifetime can be much longer than any individual assertion\'s validity window.',
+        "The IdP SSO session expiry. After this time the user must re-authenticate at the IdP. Distinct from the assertion's NotOnOrAfter — the session lifetime can be much longer than any individual assertion's validity window.",
 
     'saml.ts.notBefore':
         'The assertion is not valid before this time. Clock skew between the IdP and SP can cause validation failures here. A typical allowed skew is ±2–5 minutes.',
@@ -56,7 +56,7 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'The assertion expires at this time and must be rejected after it passes. Short validity windows (minutes rather than hours) reduce the replay attack window if the assertion is captured in transit.',
 
     'saml.ts.subjectConfirmationNotOnOrAfter':
-        'The window during which the bearer can be confirmed as the assertion\'s subject. Often matches Conditions NotOnOrAfter but may differ — the SP must check both, and both must still be within their valid windows.',
+        "The window during which the bearer can be confirmed as the assertion's subject. Often matches Conditions NotOnOrAfter but may differ — the SP must check both, and both must still be within their valid windows.",
 
     // ── SAML metadata ─────────────────────────────────────────────────────────
     'meta.signature':
@@ -93,7 +93,7 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'Assertion Consumer Service endpoints (SP) — where the IdP delivers the SAMLResponse. Each has an index; the SP names one in its AuthnRequest (or relies on isDefault). The IdP must POST only to an ACS URL listed here in signed metadata — never to an arbitrary URL from the request.',
 
     'meta.scope':
-        'The shibmd:Scope(s) this IdP is authoritative for — the domain suffix on scoped attribute values like eduPersonPrincipalName (user@university.edu). SPs should reject scoped values whose suffix is not in the IdP\'s declared scope, preventing one IdP from asserting another\'s users.',
+        "The shibmd:Scope(s) this IdP is authoritative for — the domain suffix on scoped attribute values like eduPersonPrincipalName (user@university.edu). SPs should reject scoped values whose suffix is not in the IdP's declared scope, preventing one IdP from asserting another's users.",
 
     'meta.requestedAttributes':
         'The attributes this SP declares it needs (AttributeConsumingService). isRequired="true" marks an attribute the service cannot function without. IdP administrators use this list — alongside entity categories — to decide what to release, though required does not obligate an IdP to send it.',
@@ -102,7 +102,7 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'Per-role signing policy. WantAuthnRequestsSigned (IdP) and AuthnRequestsSigned (SP) indicate whether the SP signs its AuthnRequests. WantAssertionsSigned (SP) requires the IdP to sign the assertion itself, not just the response. These advertise expectations; the relying party still enforces them.',
 
     'meta.organization':
-        'The human-readable organization behind this entity (md:Organization). OrganizationDisplayName is shown in discovery interfaces and consent screens; OrganizationURL links to the organization\'s site. Distinct from the technical EntityID.',
+        "The human-readable organization behind this entity (md:Organization). OrganizationDisplayName is shown in discovery interfaces and consent screens; OrganizationURL links to the organization's site. Distinct from the technical EntityID.",
 
     'meta.contacts':
         'Published contact people for this entity (md:ContactPerson). A technical contact handles integration and certificate rollover; a security/SIRTFI contact is the point of contact for incident response. Federations increasingly require a valid security contact.',
@@ -143,7 +143,7 @@ export const FIELD_EXPLANATIONS: Record<string, string> = {
         'The "nbf" (Not Before) claim — the token must not be accepted before this Unix timestamp. Allows tokens to be pre-issued and activated at a specific future moment, useful for scheduled or deferred access grants.',
 
     'jwt.ts.expires':
-        'The "exp" (Expiration Time) claim — the token must be rejected after this Unix timestamp. Access tokens are typically short-lived (minutes to an hour) to limit exposure if a token is stolen or leaked.',
+        'The "exp" (Expiration Time) claim — the token must be rejected after this Unix timestamp. Access tokens are typically short-lived (minutes to an hour) to limit exposure if a token is stolen or leaked.'
 };
 
 export const SAML_TS_KEY: Record<string, string> = {
@@ -151,5 +151,5 @@ export const SAML_TS_KEY: Record<string, string> = {
     SessionNotOnOrAfter: 'saml.ts.sessionNotOnOrAfter',
     NotBefore: 'saml.ts.notBefore',
     NotOnOrAfter: 'saml.ts.notOnOrAfter',
-    'SubjectConfirmation NotOnOrAfter': 'saml.ts.subjectConfirmationNotOnOrAfter',
+    'SubjectConfirmation NotOnOrAfter': 'saml.ts.subjectConfirmationNotOnOrAfter'
 };
diff --git a/src/lib/fuzz.test.ts b/src/lib/fuzz.test.ts
index 59be69c..e10e254 100644
--- a/src/lib/fuzz.test.ts
+++ b/src/lib/fuzz.test.ts
@@ -40,9 +40,7 @@ describe('fuzz: decodeJwt', () => {
 
 describe('fuzz: decodeCert — arbitrary base64 strings', () => {
     it('never throws a non-Error', () => {
-        fc.assert(
-            fc.property(fc.base64String(), (s) => neverThrowsNonError(() => decodeCert(s)))
-        );
+        fc.assert(fc.property(fc.base64String(), (s) => neverThrowsNonError(() => decodeCert(s))));
     });
 });
 
diff --git a/src/lib/generic.test.ts b/src/lib/generic.test.ts
index 9f64590..a7f6e2b 100644
--- a/src/lib/generic.test.ts
+++ b/src/lib/generic.test.ts
@@ -62,7 +62,9 @@ describe('decodeAllGeneric — URL/query string extraction', () => {
 
     it('extracts a decodable value from a full URL', () => {
         const blob = toPostBlob(AUTHN_REQUEST_XML);
-        const results = decodeAllGeneric(`https://example.com/path?token=${encodeURIComponent(blob)}`);
+        const results = decodeAllGeneric(
+            `https://example.com/path?token=${encodeURIComponent(blob)}`
+        );
         expect(results.some((r) => r.contentType === 'xml')).toBe(true);
     });
 });
@@ -104,7 +106,8 @@ describe('decodeAllGeneric — additional paths', () => {
 
     it('decodes base64 plain text with contentType=text', () => {
         // 80+ chars of base64 needed to hit the blob regex scan
-        const plainText = 'hello world, this is plain text content for testing purposes, it is long enough now';
+        const plainText =
+            'hello world, this is plain text content for testing purposes, it is long enough now';
         const blob = btoa(plainText);
         const results = decodeAllGeneric(blob);
         expect(results).toHaveLength(1);
diff --git a/src/lib/generic.ts b/src/lib/generic.ts
index 3c4ef57..e0d31e5 100644
--- a/src/lib/generic.ts
+++ b/src/lib/generic.ts
@@ -80,7 +80,11 @@ function tryBase64(raw: string): GenericDecodeResult | null {
         const text = new TextDecoder().decode(inflated);
         if (isReadable(text)) {
             const ct = detectContentType(text);
-            return { content: formatContent(text, ct), encoding: 'base64+deflate', contentType: ct };
+            return {
+                content: formatContent(text, ct),
+                encoding: 'base64+deflate',
+                contentType: ct
+            };
         }
     } catch {
         // not deflated
diff --git a/src/lib/hash.test.ts b/src/lib/hash.test.ts
index c23b9fd..d786550 100644
--- a/src/lib/hash.test.ts
+++ b/src/lib/hash.test.ts
@@ -16,7 +16,9 @@ describe('encodePayload', () => {
     });
 
     it('produces no +, /, or = characters in output', () => {
-        const result = encodePayload('SAMLRequest=abc+def/ghi=&RelayState=https%3A%2F%2Fexample.com');
+        const result = encodePayload(
+            'SAMLRequest=abc+def/ghi=&RelayState=https%3A%2F%2Fexample.com'
+        );
         expect(result).not.toMatch(/[+/=]/);
     });
 
diff --git a/src/lib/jwt.test.ts b/src/lib/jwt.test.ts
index c657c12..b21ce9c 100644
--- a/src/lib/jwt.test.ts
+++ b/src/lib/jwt.test.ts
@@ -9,15 +9,9 @@ const RS256_FULL =
     '.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLmNvbSIsInN1YiI6InVzZXIxMjMiLCJhdWQiOiJjbGllbnRfaWQiLCJpYXQiOjk5OTk5NjQwMCwiZXhwIjoxMDAwMDAwMDAwLCJuYmYiOjk5OTk5NjQwMCwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCJ9' +
     '.sig';
 
-const ALG_NONE =
-    'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0' +
-    '.eyJzdWIiOiJhdHRhY2tlciJ9' +
-    '.sig';
+const ALG_NONE = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0' + '.eyJzdWIiOiJhdHRhY2tlciJ9' + '.sig';
 
-const HS256 =
-    'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' +
-    '.eyJzdWIiOiJhdHRhY2tlciJ9' +
-    '.sig';
+const HS256 = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' + '.eyJzdWIiOiJhdHRhY2tlciJ9' + '.sig';
 
 const SCOPE_ARRAY =
     'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' +
@@ -39,10 +33,7 @@ const NO_SCOPE =
     '.eyJzdWIiOiJ1c2VyIiwiaXNzIjoiaHR0cHM6Ly9leGFtcGxlLmNvbSJ9' +
     '.sig';
 
-const NO_TIMESTAMPS =
-    'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' +
-    '.eyJzdWIiOiJ1c2VyIn0' +
-    '.sig';
+const NO_TIMESTAMPS = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' + '.eyJzdWIiOiJ1c2VyIn0' + '.sig';
 
 describe('decodeJwt — RS256 with full claims', () => {
     const result = decodeJwt(RS256_FULL);
@@ -54,7 +45,7 @@ describe('decodeJwt — RS256 with full claims', () => {
     it('populates payload', () => {
         expect(result.payload).toMatchObject({
             iss: 'https://issuer.example.com',
-            sub: 'user123',
+            sub: 'user123'
         });
     });
 
@@ -172,10 +163,7 @@ describe('decodeJwt — missing timestamps', () => {
 });
 
 // header: {"alg":42,"typ":"JWT"} — alg is a number, not a string
-const ALG_NOT_STRING =
-    'eyJhbGciOjQyLCJ0eXAiOiJKV1QifQ' +
-    '.eyJzdWIiOiJ1c2VyIn0' +
-    '.sig';
+const ALG_NOT_STRING = 'eyJhbGciOjQyLCJ0eXAiOiJKV1QifQ' + '.eyJzdWIiOiJ1c2VyIn0' + '.sig';
 
 describe('decodeJwt — non-string alg', () => {
     const result = decodeJwt(ALG_NOT_STRING);
@@ -207,8 +195,8 @@ describe('decodeJwt — error cases', () => {
 
     it('throws when payload is not valid JSON after base64url decode', () => {
         // header is valid, payload decodes to "notjson"
-        expect(() =>
-            decodeJwt('eyJhbGciOiJSUzI1NiJ9.bm90anNvbg.sig')
-        ).toThrow('could not decode payload');
+        expect(() => decodeJwt('eyJhbGciOiJSUzI1NiJ9.bm90anNvbg.sig')).toThrow(
+            'could not decode payload'
+        );
     });
 });
diff --git a/src/lib/jwt.ts b/src/lib/jwt.ts
index 12960fb..bf5b2a5 100644
--- a/src/lib/jwt.ts
+++ b/src/lib/jwt.ts
@@ -38,22 +38,20 @@ function parseScopes(payload: Record<string, unknown>): string[] | null {
     const scope = payload.scope;
     const scp = payload.scp;
 
-    if (typeof scope === 'string' && scope.trim())
-        return scope.trim().split(/\s+/);
-    if (Array.isArray(scope))
-        return scope.filter((s): s is string => typeof s === 'string');
-    if (typeof scp === 'string' && scp.trim())
-        return scp.trim().split(/\s+/);
-    if (Array.isArray(scp))
-        return scp.filter((s): s is string => typeof s === 'string');
+    if (typeof scope === 'string' && scope.trim()) return scope.trim().split(/\s+/);
+    if (Array.isArray(scope)) return scope.filter((s): s is string => typeof s === 'string');
+    if (typeof scp === 'string' && scp.trim()) return scp.trim().split(/\s+/);
+    if (Array.isArray(scp)) return scp.filter((s): s is string => typeof s === 'string');
     return null;
 }
 
 export function decodeJwt(input: string): JwtDecodeResult {
-    const trimmed = input.trim().replace(/^Authorization:\s+/i, '').replace(/^Bearer\s+/i, '');
+    const trimmed = input
+        .trim()
+        .replace(/^Authorization:\s+/i, '')
+        .replace(/^Bearer\s+/i, '');
     const parts = trimmed.split('.');
-    if (parts.length !== 3)
-        throw new Error('Invalid JWT: expected 3 dot-separated parts');
+    if (parts.length !== 3) throw new Error('Invalid JWT: expected 3 dot-separated parts');
 
     const [headerB64, payloadB64, signature] = parts;
 
@@ -86,8 +84,8 @@ export function decodeJwt(input: string): JwtDecodeResult {
         timestamps: {
             iat: parseTimestamp(payload.iat),
             exp: parseTimestamp(payload.exp),
-            nbf: parseTimestamp(payload.nbf),
+            nbf: parseTimestamp(payload.nbf)
         },
-        scopes: parseScopes(payload),
+        scopes: parseScopes(payload)
     };
 }
diff --git a/src/lib/metadata-checks.test.ts b/src/lib/metadata-checks.test.ts
index 5b9f351..1465da7 100644
--- a/src/lib/metadata-checks.test.ts
+++ b/src/lib/metadata-checks.test.ts
@@ -91,7 +91,9 @@ describe('checkMetadata', () => {
         expect(t).toContain('Certificate contains PEM headers');
         expect(t).toContain('IdP has a plaintext (HTTP) endpoint');
         expect(checks.find((c) => c.title === 'Metadata expired')?.severity).toBe('error');
-        expect(checks.find((c) => c.title === 'Certificate contains PEM headers')?.severity).toBe('error');
+        expect(checks.find((c) => c.title === 'Certificate contains PEM headers')?.severity).toBe(
+            'error'
+        );
     });
 
     it('warns on imminent expiry, whitespace entityID, and a role with no certificate', () => {
diff --git a/src/lib/metadata.test.ts b/src/lib/metadata.test.ts
index 2c028d7..55ce20d 100644
--- a/src/lib/metadata.test.ts
+++ b/src/lib/metadata.test.ts
@@ -160,7 +160,10 @@ describe('isMetadata', () => {
         ['EntitiesDescriptor aggregate', '<md:EntitiesDescriptor>'],
         ['with XML prolog', '<?xml version="1.0"?>\n<md:EntityDescriptor>'],
         ['with leading comment', '<!-- exported --> <md:EntityDescriptor>'],
-        ['with prolog and multiple comments', '<?xml version="1.0"?><!--a--> <!--b--><md:EntityDescriptor>'],
+        [
+            'with prolog and multiple comments',
+            '<?xml version="1.0"?><!--a--> <!--b--><md:EntityDescriptor>'
+        ],
         ['with a BOM', '\uFEFF<md:EntityDescriptor>'],
         ['self-closing', '<md:EntityDescriptor/>']
     ])('detects %s', (_label, input) => {
@@ -237,8 +240,20 @@ describe('parseMetadata — IdP', () => {
     it('parses SSO and SLO endpoints with response location', () => {
         const r = role('idp');
         expect(r.singleSignOnServices).toEqual([
-            { binding: B('HTTP-Redirect'), location: 'https://shibidp.virginia.edu/idp/profile/SAML2/Redirect/SSO', responseLocation: undefined, index: undefined, isDefault: undefined },
-            { binding: B('HTTP-POST'), location: 'https://shibidp.virginia.edu/idp/profile/SAML2/POST/SSO', responseLocation: undefined, index: undefined, isDefault: undefined }
+            {
+                binding: B('HTTP-Redirect'),
+                location: 'https://shibidp.virginia.edu/idp/profile/SAML2/Redirect/SSO',
+                responseLocation: undefined,
+                index: undefined,
+                isDefault: undefined
+            },
+            {
+                binding: B('HTTP-POST'),
+                location: 'https://shibidp.virginia.edu/idp/profile/SAML2/POST/SSO',
+                responseLocation: undefined,
+                index: undefined,
+                isDefault: undefined
+            }
         ]);
         expect(r.singleLogoutServices[0].responseLocation).toBe(
             'https://shibidp.virginia.edu/idp/profile/SAML2/Redirect/SLO'
@@ -251,7 +266,9 @@ describe('parseMetadata — IdP', () => {
         expect(m.descriptions[0].value).toBe('UVA Shibboleth IdP');
         expect(m.informationURLs[0].value).toBe('https://virginia.edu/about');
         expect(m.privacyURLs[0].value).toBe('https://virginia.edu/privacy');
-        expect(m.logos).toEqual([{ url: 'https://virginia.edu/logo.png', width: '80', height: '60' }]);
+        expect(m.logos).toEqual([
+            { url: 'https://virginia.edu/logo.png', width: '80', height: '60' }
+        ]);
     });
 
     it('parses organization', () => {
@@ -293,7 +310,13 @@ describe('parseMetadata — SP', () => {
 
     it('parses indexed ACS endpoints with default flag', () => {
         const acs = role('sp', sp()).assertionConsumerServices!;
-        expect(acs[0]).toEqual({ binding: B('HTTP-POST'), location: 'https://sp.example.org/acs', responseLocation: undefined, index: 0, isDefault: true });
+        expect(acs[0]).toEqual({
+            binding: B('HTTP-POST'),
+            location: 'https://sp.example.org/acs',
+            responseLocation: undefined,
+            index: 0,
+            isDefault: true
+        });
         expect(acs[1].index).toBe(1);
         expect(acs[1].isDefault).toBeUndefined();
     });
@@ -377,12 +400,20 @@ describe('label maps', () => {
     it('maps known bindings and entity categories with spec URLs', () => {
         expect(BINDING_LABELS[B('HTTP-POST')]).toBe('HTTP-POST');
         expect(BINDING_LABELS[B('HTTP-POST-SimpleSign')]).toBe('HTTP-POST-SimpleSign');
-        expect(BINDING_LABELS['urn:mace:shibboleth:1.0:profiles:AuthnRequest']).toBe('Shibboleth 1.0 AuthnRequest');
+        expect(BINDING_LABELS['urn:mace:shibboleth:1.0:profiles:AuthnRequest']).toBe(
+            'Shibboleth 1.0 AuthnRequest'
+        );
         expect(ENTITY_CATEGORY_LABELS['https://refeds.org/sirtfi']).toBe('SIRTFI');
-        expect(ENTITY_CATEGORY_LABELS['http://id.incommon.org/category/registered-by-incommon']).toBe('Registered by InCommon');
-        expect(ENTITY_CATEGORY_LABELS['http://www.swamid.se/category/research-and-education']).toBe('R&E (SWAMID)');
+        expect(
+            ENTITY_CATEGORY_LABELS['http://id.incommon.org/category/registered-by-incommon']
+        ).toBe('Registered by InCommon');
+        expect(ENTITY_CATEGORY_LABELS['http://www.swamid.se/category/research-and-education']).toBe(
+            'R&E (SWAMID)'
+        );
         expect(ENTITY_CATEGORY_LABELS['https://idem.garr.it/af/IDEM-P1']).toBe('IDEM P1');
-        expect(ENTITY_CATEGORY_LABELS['http://www.geant.net/uri/dataprotection-code-of-conduct/v2']).toBe('GÉANT CoCo v2');
+        expect(
+            ENTITY_CATEGORY_LABELS['http://www.geant.net/uri/dataprotection-code-of-conduct/v2']
+        ).toBe('GÉANT CoCo v2');
         expect(ENTITY_CATEGORY_SPEC_URLS['https://refeds.org/sirtfi']).toMatch(/^https:\/\//);
     });
 });
diff --git a/src/lib/metadata.ts b/src/lib/metadata.ts
index a7635b1..c85daf8 100644
--- a/src/lib/metadata.ts
+++ b/src/lib/metadata.ts
@@ -214,7 +214,10 @@ function parseEntity(el: Element): EntityMetadata {
         entityId: attr(el, 'entityID') ?? '',
         validUntil: attr(el, 'validUntil'),
         cacheDuration: attr(el, 'cacheDuration'),
-        registrationAuthority: attr(getEl(el, NS_MDRPI, 'RegistrationInfo'), 'registrationAuthority'),
+        registrationAuthority: attr(
+            getEl(el, NS_MDRPI, 'RegistrationInfo'),
+            'registrationAuthority'
+        ),
         entityCategories: parseEntityCategories(el),
         organization,
         contacts: getEls(el, NS_MD, 'ContactPerson').map(parseContact),
@@ -251,7 +254,9 @@ function parseContact(el: Element): ContactPerson {
 function parseRole(el: Element, kind: 'idp' | 'sp'): RoleDescriptor {
     const role: RoleDescriptor = {
         kind,
-        protocolSupport: (attr(el, 'protocolSupportEnumeration') ?? '').split(/\s+/).filter(Boolean),
+        protocolSupport: (attr(el, 'protocolSupportEnumeration') ?? '')
+            .split(/\s+/)
+            .filter(Boolean),
         keys: parseKeys(el),
         nameIdFormats: getEls(el, NS_MD, 'NameIDFormat')
             .map((f) => txt(f))
@@ -390,17 +395,22 @@ const REFEDS_CoC_HOME = 'https://wiki.refeds.org/display/CODE/Data+Protection+Co
 
 export const ENTITY_CATEGORY_SPEC_URLS: Record<string, string> = {
     // R&S
-    'http://refeds.org/category/research-and-scholarship': 'https://refeds.org/category/research-and-scholarship',
-    'https://refeds.org/category/research-and-scholarship': 'https://refeds.org/category/research-and-scholarship',
+    'http://refeds.org/category/research-and-scholarship':
+        'https://refeds.org/category/research-and-scholarship',
+    'https://refeds.org/category/research-and-scholarship':
+        'https://refeds.org/category/research-and-scholarship',
     'http://id.incommon.org/category/research-and-scholarship':
         'https://incommon.org/federation/research-scholarship-adopters/',
     // Code of Conduct
     'http://www.geant.net/uri/dataprotection-code-of-conduct/v1': REFEDS_CoC_HOME,
     'https://www.geant.net/uri/dataprotection-code-of-conduct/v1': REFEDS_CoC_HOME,
     'http://www.geant.net/uri/dataprotection-code-of-conduct/v2': REFEDS_CoC_HOME,
-    'https://geant.org/category/code-of-conduct/v2': 'https://refeds.org/category/code-of-conduct/v2',
-    'https://refeds.org/category/code-of-conduct/v1': 'https://refeds.org/category/code-of-conduct/v1',
-    'https://refeds.org/category/code-of-conduct/v2': 'https://refeds.org/category/code-of-conduct/v2',
+    'https://geant.org/category/code-of-conduct/v2':
+        'https://refeds.org/category/code-of-conduct/v2',
+    'https://refeds.org/category/code-of-conduct/v1':
+        'https://refeds.org/category/code-of-conduct/v1',
+    'https://refeds.org/category/code-of-conduct/v2':
+        'https://refeds.org/category/code-of-conduct/v2',
     // SIRTFI & assurance
     'https://refeds.org/sirtfi': 'https://refeds.org/sirtfi',
     'http://refeds.org/sirtfi': 'https://refeds.org/sirtfi',
@@ -427,8 +437,10 @@ export const ENTITY_CATEGORY_SPEC_URLS: Record<string, string> = {
     // Other well-known
     'http://www.swamid.se/category/research-and-education': 'https://wiki.sunet.se/display/SWAMID',
     'http://www.swamid.se/category/hei-service': 'https://wiki.sunet.se/display/SWAMID',
-    'http://clarin.eu/category/clarin-member': 'https://www.clarin.eu/content/service-provider-federation',
-    'https://myacademicid.org/entity-categories/esi': 'https://myacademicid.org/entity-categories/esi',
+    'http://clarin.eu/category/clarin-member':
+        'https://www.clarin.eu/content/service-provider-federation',
+    'https://myacademicid.org/entity-categories/esi':
+        'https://myacademicid.org/entity-categories/esi',
     // Registration markers
     'http://id.incommon.org/category/registered-by-incommon':
         'https://incommon.org/federation/entity-categories/',
diff --git a/src/lib/saml.test.ts b/src/lib/saml.test.ts
index c6d9c36..cb7a7a6 100644
--- a/src/lib/saml.test.ts
+++ b/src/lib/saml.test.ts
@@ -1,5 +1,13 @@
 import { describe, it, expect } from 'vitest';
-import { decodeSaml, decodeAllSaml, prettyPrintXml, AUTHN_CONTEXT_LABELS, AUTHN_CONTEXT_SPEC_URLS, STATUS_DESCRIPTIONS, STATUS_SPEC_URLS } from '$lib/saml';
+import {
+    decodeSaml,
+    decodeAllSaml,
+    prettyPrintXml,
+    AUTHN_CONTEXT_LABELS,
+    AUTHN_CONTEXT_SPEC_URLS,
+    STATUS_DESCRIPTIONS,
+    STATUS_SPEC_URLS
+} from '$lib/saml';
 import {
     AUTHN_REQUEST_XML,
     AUTHN_REQUEST_WITH_CONTEXT_XML,
@@ -38,16 +46,12 @@ describe('decodeSaml — redirect binding (base64+deflate)', () => {
     });
 
     it('decodes a full URL', () => {
-        const r = decodeSaml(
-            `https://idp.example.com/sso?SAMLRequest=${encodeURIComponent(blob)}`
-        );
+        const r = decodeSaml(`https://idp.example.com/sso?SAMLRequest=${encodeURIComponent(blob)}`);
         expect(r.summary.issuer).toBe('https://sp.example.com');
     });
 
     it('decodes an HTTP log line (GET format)', () => {
-        const r = decodeSaml(
-            `GET /sso?SAMLRequest=${encodeURIComponent(blob)} HTTP/1.1`
-        );
+        const r = decodeSaml(`GET /sso?SAMLRequest=${encodeURIComponent(blob)} HTTP/1.1`);
         expect(r.summary.issuer).toBe('https://sp.example.com');
     });
 
@@ -143,7 +147,9 @@ describe('decodeSaml — error cases', () => {
 
     it('throws when decoded content looks like XML but is malformed', () => {
         // base64 of text starting with '<' but failing XML parse
-        expect(() => decodeSaml(btoa('<malformed &xml>'))).toThrow('Decoded content is not valid XML');
+        expect(() => decodeSaml(btoa('<malformed &xml>'))).toThrow(
+            'Decoded content is not valid XML'
+        );
     });
 
     it('handles malformed percent-encoding in query strings gracefully', () => {
@@ -479,13 +485,14 @@ describe('prettyPrintXml', () => {
     it('wraps self-closing tags whose line exceeds 100 chars', () => {
         const xml = `<sc:Code ${`a="${'x'.repeat(40)}"`.repeat(3)}/>`;
         const pretty = prettyPrintXml(`<root>${xml}</root>`);
-        const codeLine = pretty.split('\n').find(l => l.includes('sc:Code'))!;
+        const codeLine = pretty.split('\n').find((l) => l.includes('sc:Code'))!;
         expect(codeLine.length).toBeLessThanOrEqual(100);
     });
 
     it('packs multiple short attributes onto the same continuation line', () => {
         // tag is long due to namespace, but short attrs should pack together
-        const xml = '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_r1" Version="2.0" IssueInstant="2024-01-01T00:00:00Z"></samlp:Response>';
+        const xml =
+            '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_r1" Version="2.0" IssueInstant="2024-01-01T00:00:00Z"></samlp:Response>';
         const pretty = prettyPrintXml(xml);
         // ID and Version are short — both should appear on the same continuation line
         expect(pretty).toMatch(/ID="_r1" Version="2\.0"/);
@@ -504,7 +511,8 @@ describe('prettyPrintXml', () => {
     });
 
     it('handles standalone (boolean) attributes in long tags', () => {
-        const xml = '<el xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" standalone/>';
+        const xml =
+            '<el xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" standalone/>';
         const pretty = prettyPrintXml(`<root>${xml}</root>`);
         expect(pretty).toContain('standalone');
     });
@@ -516,7 +524,8 @@ describe('prettyPrintXml', () => {
     });
 
     it('handles single-quoted attribute values in long tags', () => {
-        const xml = "<samlp:Response xmlns:samlp='urn:oasis:names:tc:SAML:2.0:protocol' xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion' ID='_r1'></samlp:Response>";
+        const xml =
+            "<samlp:Response xmlns:samlp='urn:oasis:names:tc:SAML:2.0:protocol' xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion' ID='_r1'></samlp:Response>";
         const pretty = prettyPrintXml(xml);
         expect(pretty).toContain("xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'");
     });
@@ -576,7 +585,9 @@ describe('parseSummary — requestedAuthnContext', () => {
             ''
         );
         const r = decodeSaml(toRedirectBlob(xml));
-        expect(r.summary.requestedAuthnContext?.classRefs).toEqual(['https://refeds.org/profile/mfa']);
+        expect(r.summary.requestedAuthnContext?.classRefs).toEqual([
+            'https://refeds.org/profile/mfa'
+        ]);
     });
 });
 
@@ -606,7 +617,11 @@ describe('parseSummary — error response', () => {
 
 describe('AUTHN_CONTEXT_LABELS', () => {
     it('has a label for PasswordProtectedTransport', () => {
-        expect(AUTHN_CONTEXT_LABELS['urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport']).toBe('Password (HTTPS)');
+        expect(
+            AUTHN_CONTEXT_LABELS[
+                'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+            ]
+        ).toBe('Password (HTTPS)');
     });
 
     it('has labels for REFEDS MFA and SFA', () => {
@@ -615,8 +630,12 @@ describe('AUTHN_CONTEXT_LABELS', () => {
     });
 
     it('has labels for REFEDS Assurance Framework entries', () => {
-        expect(AUTHN_CONTEXT_LABELS['https://refeds.org/assurance/IAP/high']).toBe('REFEDS IAP High');
-        expect(AUTHN_CONTEXT_LABELS['https://refeds.org/assurance/ID/eppn-unique-no-reassign']).toBe('REFEDS EPPN (no reassign)');
+        expect(AUTHN_CONTEXT_LABELS['https://refeds.org/assurance/IAP/high']).toBe(
+            'REFEDS IAP High'
+        );
+        expect(
+            AUTHN_CONTEXT_LABELS['https://refeds.org/assurance/ID/eppn-unique-no-reassign']
+        ).toBe('REFEDS EPPN (no reassign)');
     });
 
     it('has labels for NIST/FICAM entries', () => {
@@ -633,18 +652,27 @@ describe('AUTHN_CONTEXT_LABELS', () => {
 
 describe('AUTHN_CONTEXT_SPEC_URLS', () => {
     it('maps SAML 2.0 URNs to the OASIS spec PDF', () => {
-        const ppt = AUTHN_CONTEXT_SPEC_URLS['urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'];
+        const ppt =
+            AUTHN_CONTEXT_SPEC_URLS[
+                'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+            ];
         expect(ppt).toContain('oasis-open.org');
         expect(ppt).toContain('.pdf');
     });
 
     it('maps REFEDS MFA to its own URI', () => {
-        expect(AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/profile/mfa']).toBe('https://refeds.org/profile/mfa');
+        expect(AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/profile/mfa']).toBe(
+            'https://refeds.org/profile/mfa'
+        );
     });
 
     it('maps REFEDS Assurance entries to the RAF landing page', () => {
-        expect(AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/assurance/IAP/medium']).toBe('https://refeds.org/assurance');
-        expect(AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/assurance/ID/eppn-unique-no-reassign']).toBe('https://refeds.org/assurance');
+        expect(AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/assurance/IAP/medium']).toBe(
+            'https://refeds.org/assurance'
+        );
+        expect(
+            AUTHN_CONTEXT_SPEC_URLS['https://refeds.org/assurance/ID/eppn-unique-no-reassign']
+        ).toBe('https://refeds.org/assurance');
     });
 
     it('maps NIST/FICAM entries to the NIST 800-63 PDF', () => {
@@ -661,7 +689,10 @@ describe('AUTHN_CONTEXT_SPEC_URLS', () => {
 
     it('all spec URLs are valid HTTPS URLs', () => {
         for (const [uri, specUrl] of Object.entries(AUTHN_CONTEXT_SPEC_URLS)) {
-            expect(specUrl.startsWith('https://'), `spec URL not HTTPS for ${uri}: ${specUrl}`).toBe(true);
+            expect(
+                specUrl.startsWith('https://'),
+                `spec URL not HTTPS for ${uri}: ${specUrl}`
+            ).toBe(true);
         }
     });
 });
@@ -670,7 +701,9 @@ describe('STATUS_DESCRIPTIONS', () => {
     it('has descriptions for top-level codes', () => {
         expect(STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:Requester']).toBeTruthy();
         expect(STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:Responder']).toBeTruthy();
-        expect(STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:VersionMismatch']).toBeTruthy();
+        expect(
+            STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:VersionMismatch']
+        ).toBeTruthy();
     });
 
     it('has a description for AuthnFailed', () => {
@@ -678,7 +711,9 @@ describe('STATUS_DESCRIPTIONS', () => {
     });
 
     it('has a description for NoAuthnContext', () => {
-        expect(STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext']).toBeTruthy();
+        expect(
+            STATUS_DESCRIPTIONS['urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext']
+        ).toBeTruthy();
     });
 
     it('has no empty description values', () => {
diff --git a/src/lib/saml.ts b/src/lib/saml.ts
index 57857cb..5665905 100644
--- a/src/lib/saml.ts
+++ b/src/lib/saml.ts
@@ -86,10 +86,11 @@ export const AUTHN_CONTEXT_LABELS: Record<string, string> = {
     [`${NIST_HTTP_PFX}ial/2`]: 'IAL2',
     [`${NIST_HTTP_PFX}aal/1`]: 'AAL1',
     [`${NIST_HTTP_PFX}aal/2`]: 'AAL2',
-    [`${NIST_HTTP_PFX}aal/3`]: 'AAL3',
+    [`${NIST_HTTP_PFX}aal/3`]: 'AAL3'
 };
 
-const OASIS_AC_SPEC = 'https://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf';
+const OASIS_AC_SPEC =
+    'https://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf';
 const NIST_800_63 = 'https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf';
 
 export const AUTHN_CONTEXT_SPEC_URLS: Record<string, string> = {
@@ -130,7 +131,7 @@ export const AUTHN_CONTEXT_SPEC_URLS: Record<string, string> = {
     [`${NIST_HTTP_PFX}ial/2`]: NIST_800_63,
     [`${NIST_HTTP_PFX}aal/1`]: NIST_800_63,
     [`${NIST_HTTP_PFX}aal/2`]: NIST_800_63,
-    [`${NIST_HTTP_PFX}aal/3`]: NIST_800_63,
+    [`${NIST_HTTP_PFX}aal/3`]: NIST_800_63
 };
 
 const ST_PFX = 'urn:oasis:names:tc:SAML:2.0:status:';
@@ -143,7 +144,7 @@ export const STATUS_DESCRIPTIONS: Record<string, string> = {
     [`${ST_PFX}VersionMismatch`]:
         'The SAML version specified in the request is not supported by this IdP.',
     [`${ST_PFX}AuthnFailed`]:
-        "The IdP was unable to authenticate the principal — wrong credentials, locked account, or a failed MFA step.",
+        'The IdP was unable to authenticate the principal — wrong credentials, locked account, or a failed MFA step.',
     [`${ST_PFX}InvalidAttrNameOrValue`]:
         'An Attribute or AttributeValue element contained unexpected or invalid content — often a misconfigured attribute release policy.',
     [`${ST_PFX}InvalidNameIDPolicy`]:
@@ -158,8 +159,7 @@ export const STATUS_DESCRIPTIONS: Record<string, string> = {
         'The IdP proxy could not find a supported IdP for the requested principal.',
     [`${ST_PFX}PartialLogout`]:
         'Single logout completed only partially — not all sessions at participating SPs could be terminated.',
-    [`${ST_PFX}ProxyCountExceeded`]:
-        'The ProxyCount limit was exceeded in an IdP-proxy chain.',
+    [`${ST_PFX}ProxyCountExceeded`]: 'The ProxyCount limit was exceeded in an IdP-proxy chain.',
     [`${ST_PFX}RequestDenied`]:
         'The IdP refused to perform the requested operation — typically a policy block, consent requirement, or SP not authorized.',
     [`${ST_PFX}RequestUnsupported`]:
@@ -174,12 +174,10 @@ export const STATUS_DESCRIPTIONS: Record<string, string> = {
         'The resource specified in the request is not recognized by this IdP.',
     [`${ST_PFX}TooManyResponses`]:
         'Too many matching responses exist; the IdP cannot return all of them.',
-    [`${ST_PFX}UnknownAttrProfile`]:
-        'An unknown attribute profile was requested.',
-    [`${ST_PFX}UnknownPrincipal`]:
-        'The specified principal is not known to this IdP.',
+    [`${ST_PFX}UnknownAttrProfile`]: 'An unknown attribute profile was requested.',
+    [`${ST_PFX}UnknownPrincipal`]: 'The specified principal is not known to this IdP.',
     [`${ST_PFX}UnsupportedBinding`]:
-        'The binding specified in the request is not supported by this IdP.',
+        'The binding specified in the request is not supported by this IdP.'
 };
 
 const SAML_CORE_SPEC = 'https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf';
@@ -207,7 +205,7 @@ export const STATUS_SPEC_URLS: Record<string, string> = {
     [`${ST_PFX}TooManyResponses`]: SAML_CORE_SPEC,
     [`${ST_PFX}UnknownAttrProfile`]: SAML_CORE_SPEC,
     [`${ST_PFX}UnknownPrincipal`]: SAML_CORE_SPEC,
-    [`${ST_PFX}UnsupportedBinding`]: SAML_CORE_SPEC,
+    [`${ST_PFX}UnsupportedBinding`]: SAML_CORE_SPEC
 };
 
 export interface SamlDecodeResult {
@@ -508,10 +506,19 @@ function splitAttrs(s: string): string[] {
     const result: string[] = [];
     let i = 0;
     while (i < s.length) {
-        while (i < s.length && (s[i] === ' ' || s[i] === '\n' || s[i] === '\r' || s[i] === '\t')) i++;
+        while (i < s.length && (s[i] === ' ' || s[i] === '\n' || s[i] === '\r' || s[i] === '\t'))
+            i++;
         if (i >= s.length) break;
         const start = i;
-        while (i < s.length && s[i] !== '=' && s[i] !== ' ' && s[i] !== '\n' && s[i] !== '\r' && s[i] !== '\t') i++;
+        while (
+            i < s.length &&
+            s[i] !== '=' &&
+            s[i] !== ' ' &&
+            s[i] !== '\n' &&
+            s[i] !== '\r' &&
+            s[i] !== '\t'
+        )
+            i++;
         if (i < s.length && s[i] === '=') {
             i++;
             /* v8 ignore next */
@@ -591,7 +598,11 @@ export function prettyPrintXml(xml: string): string {
                     lines.push(current);
                     current = '';
                 }
-                lines.push(tag.endsWith('/>') ? wrapOpenTag(tag, '  '.repeat(indent)) : '  '.repeat(indent) + tag);
+                lines.push(
+                    tag.endsWith('/>')
+                        ? wrapOpenTag(tag, '  '.repeat(indent))
+                        : '  '.repeat(indent) + tag
+                );
             } else {
                 // Opening tag
                 if (current) lines.push(current);
diff --git a/src/lib/xml-highlight.test.ts b/src/lib/xml-highlight.test.ts
index 09e57dc..557f16a 100644
--- a/src/lib/xml-highlight.test.ts
+++ b/src/lib/xml-highlight.test.ts
@@ -28,7 +28,9 @@ describe('highlightXml — element names', () => {
     });
 
     it('handles self-closing tags', () => {
-        const result = highlightXml('<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>');
+        const result = highlightXml(
+            '<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>'
+        );
         expect(result).toContain('data-el="StatusCode"');
         expect(result).toContain('/&gt;');
     });
@@ -87,7 +89,7 @@ describe('highlightXml — attributes', () => {
     it('handles single-quoted attribute values', () => {
         const result = highlightXml("<foo bar='baz'>");
         expect(result).toContain('<span class="xml-attr-name">bar</span>');
-        expect(result).toContain("<span class=\"xml-attr-val\">'baz'</span>");
+        expect(result).toContain('<span class="xml-attr-val">\'baz\'</span>');
     });
 
     it('handles attributes without a value at end of tag', () => {
@@ -173,21 +175,44 @@ describe('highlightXml — full round-trip', () => {
 
 describe('XML_ELEMENT_TIPS', () => {
     it('has non-empty tips for core SAML elements', () => {
-        const coreElements = ['Assertion', 'Issuer', 'Subject', 'NameID', 'Conditions', 'AuthnStatement', 'AuthnContextClassRef', 'AttributeStatement', 'Attribute'];
+        const coreElements = [
+            'Assertion',
+            'Issuer',
+            'Subject',
+            'NameID',
+            'Conditions',
+            'AuthnStatement',
+            'AuthnContextClassRef',
+            'AttributeStatement',
+            'Attribute'
+        ];
         for (const el of coreElements) {
             expect(XML_ELEMENT_TIPS[el], `missing tip for ${el}`).toBeTruthy();
         }
     });
 
     it('has non-empty tips for protocol elements', () => {
-        const protoElements = ['Response', 'AuthnRequest', 'Status', 'StatusCode', 'RequestedAuthnContext', 'NameIDPolicy'];
+        const protoElements = [
+            'Response',
+            'AuthnRequest',
+            'Status',
+            'StatusCode',
+            'RequestedAuthnContext',
+            'NameIDPolicy'
+        ];
         for (const el of protoElements) {
             expect(XML_ELEMENT_TIPS[el], `missing tip for ${el}`).toBeTruthy();
         }
     });
 
     it('has non-empty tips for signature elements', () => {
-        const sigElements = ['Signature', 'SignedInfo', 'SignatureValue', 'X509Certificate', 'DigestValue'];
+        const sigElements = [
+            'Signature',
+            'SignedInfo',
+            'SignatureValue',
+            'X509Certificate',
+            'DigestValue'
+        ];
         for (const el of sigElements) {
             expect(XML_ELEMENT_TIPS[el], `missing tip for ${el}`).toBeTruthy();
         }
diff --git a/src/lib/xml-highlight.ts b/src/lib/xml-highlight.ts
index fd3d0ee..d0276d8 100644
--- a/src/lib/xml-highlight.ts
+++ b/src/lib/xml-highlight.ts
@@ -2,12 +2,10 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
     // ── SAML assertion ────────────────────────────────────────────────────────
     Assertion:
         'The core SAML 2.0 assertion — a signed, time-bounded statement from the IdP about an authenticated principal. Contains authentication, attribute, and/or authorization decision statements.',
-    Issuer:
-        "Identifies the entity that issued this message. For a Response this is the IdP's EntityID; for a Request it is the SP's EntityID. Must match the EntityID in the issuer's SAML metadata.",
+    Issuer: "Identifies the entity that issued this message. For a Response this is the IdP's EntityID; for a Request it is the SP's EntityID. Must match the EntityID in the issuer's SAML metadata.",
     Subject:
         'The principal (user) this assertion is about. Contains a NameID and a SubjectConfirmation that together identify who authenticated and allow the recipient to verify they are the intended audience.',
-    NameID:
-        'The subject identifier, typed by the Format attribute — emailAddress (user@domain), persistent (opaque and SP-scoped, survives sessions), transient (single-session, privacy-preserving), or unspecified.',
+    NameID: 'The subject identifier, typed by the Format attribute — emailAddress (user@domain), persistent (opaque and SP-scoped, survives sessions), transient (single-session, privacy-preserving), or unspecified.',
     SubjectConfirmation:
         'Specifies the method by which the subject can be confirmed as the intended bearer. For browser SSO the method is always urn:oasis:names:tc:SAML:2.0:cm:bearer.',
     SubjectConfirmationData:
@@ -15,7 +13,7 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
     Conditions:
         'Time and audience restrictions on this assertion. The SP must verify the current time falls within [NotBefore, NotOnOrAfter) and that its EntityID appears in AudienceRestriction.',
     AudienceRestriction:
-        "Restricts this assertion to one or more intended recipients. The SP must verify that its own EntityID is listed — using an assertion intended for another SP is a security violation.",
+        'Restricts this assertion to one or more intended recipients. The SP must verify that its own EntityID is listed — using an assertion intended for another SP is a security violation.',
     Audience:
         'An EntityID for which this assertion is intended. The SP must reject assertions where its EntityID does not appear in at least one AudienceRestriction.',
     OneTimeUse:
@@ -46,10 +44,9 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
         "A request to terminate the principal's sessions across the federation. Initiates the single logout (SLO) flow. The SessionIndex links this to the specific IdP session to terminate.",
     LogoutResponse:
         'A response to a LogoutRequest confirming the logout outcome. PartialLogout status means some SP sessions could not be terminated.',
-    Status:
-        'The outcome of this protocol exchange. Always present in Responses. Contains a StatusCode and optionally a StatusMessage and StatusDetail.',
+    Status: 'The outcome of this protocol exchange. Always present in Responses. Contains a StatusCode and optionally a StatusMessage and StatusDetail.',
     StatusCode:
-        "A URI identifying the outcome. Top-level: Success, Requester (SP-side error), Responder (IdP-side error), VersionMismatch. Sub-codes provide more specific detail — e.g., AuthnFailed, NoAuthnContext.",
+        'A URI identifying the outcome. Top-level: Success, Requester (SP-side error), Responder (IdP-side error), VersionMismatch. Sub-codes provide more specific detail — e.g., AuthnFailed, NoAuthnContext.',
     StatusMessage:
         'A human-readable message from the IdP describing the status outcome. Present primarily on error responses. Content is IdP-specific and not standardized across implementations.',
     StatusDetail:
@@ -98,7 +95,8 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
     EncryptionMethod:
         'The encryption algorithm used. Typically AES-128-CBC or AES-256-GCM for assertion content; RSA-OAEP for the wrapped session key.',
     CipherData: 'Container for the encrypted bytes.',
-    CipherValue: 'The Base64-encoded ciphertext — the actual encrypted assertion or session key content.',
+    CipherValue:
+        'The Base64-encoded ciphertext — the actual encrypted assertion or session key content.',
 
     // ── SAML metadata ─────────────────────────────────────────────────────────
     EntitiesDescriptor:
@@ -125,8 +123,7 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
         'Declares the named service and the set of attributes this SP requests from the IdP. IdP administrators consult it when deciding attribute release.',
     ServiceName:
         'A human-readable, optionally localized name for the SP service, used in consent and discovery interfaces.',
-    ServiceDescription:
-        'A human-readable, optionally localized description of the SP service.',
+    ServiceDescription: 'A human-readable, optionally localized description of the SP service.',
     RequestedAttribute:
         'An attribute this SP requests, by Name (usually an OID-style URN) and FriendlyName. isRequired="true" marks it as essential to the service.',
     NameIDFormat:
@@ -134,32 +131,35 @@ export const XML_ELEMENT_TIPS: Record<string, string> = {
     Organization:
         'The human-readable organization responsible for this entity — its name, display name, and URL, optionally localized.',
     OrganizationName: 'The formal, machine-oriented organization name.',
-    OrganizationDisplayName: 'The organization name shown to users in discovery and consent screens.',
+    OrganizationDisplayName:
+        'The organization name shown to users in discovery and consent screens.',
     OrganizationURL: "A link to the organization's website.",
     ContactPerson:
         'A published contact for this entity, typed by contactType — technical, support, administrative, billing, or other. A security/SIRTFI contact is the point of contact for incident response.',
     Company: 'The company or organization the contact belongs to.',
-    GivenName: 'The contact\'s given (first) name.',
-    SurName: 'The contact\'s surname (last name).',
+    GivenName: "The contact's given (first) name.",
+    SurName: "The contact's surname (last name).",
     EmailAddress: "The contact's email address, often prefixed with mailto:.",
     TelephoneNumber: "The contact's telephone number.",
-    UIInfo:
-        'User-interface metadata (mdui) — display name, description, and logo shown for this entity in discovery services and consent screens, often localized per language.',
+    UIInfo: 'User-interface metadata (mdui) — display name, description, and logo shown for this entity in discovery services and consent screens, often localized per language.',
     DisplayName: 'A localized, user-facing display name for the entity.',
     Description: 'A localized, user-facing description of the entity.',
     InformationURL: 'A localized link to more information about the entity.',
     PrivacyStatementURL: "A localized link to the entity's privacy statement.",
     Logo: 'A logo for the entity, with width and height, shown in discovery and consent interfaces.',
-    Scope:
-        'The domain suffix this IdP is authoritative for (shibmd:Scope). Scoped attribute values like eduPersonPrincipalName (user@domain) must match this scope; SPs should reject values that do not.',
+    Scope: 'The domain suffix this IdP is authoritative for (shibmd:Scope). Scoped attribute values like eduPersonPrincipalName (user@domain) must match this scope; SPs should reject values that do not.',
     RegistrationInfo:
         'Identifies the federation registrar (registrationAuthority) that registered this metadata — the basis for inter-federation (eduGAIN) trust.',
     EntityAttributes:
-        'Carries entity category and assurance tags as SAML Attributes — e.g. Research & Scholarship, SIRTFI, or Code of Conduct — that drive IdP attribute-release policy.',
+        'Carries entity category and assurance tags as SAML Attributes — e.g. Research & Scholarship, SIRTFI, or Code of Conduct — that drive IdP attribute-release policy.'
 };
 
 function esc(s: string): string {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
 }
 
 function localName(qname: string): string {
@@ -170,9 +170,7 @@ function localName(qname: string): string {
 function elSpan(qname: string): string {
     const local = localName(qname);
     const hasTip = local in XML_ELEMENT_TIPS;
-    const attrs = hasTip
-        ? ` class="xml-el xml-el-tip" data-el="${esc(local)}"`
-        : ' class="xml-el"';
+    const attrs = hasTip ? ` class="xml-el xml-el-tip" data-el="${esc(local)}"` : ' class="xml-el"';
     return `<span${attrs}>${esc(qname)}</span>`;
 }
 
@@ -188,7 +186,15 @@ function highlightAttrs(s: string): string {
         }
         // attribute name — scan to '=' or whitespace
         const nameStart = i;
-        while (i < s.length && s[i] !== '=' && s[i] !== ' ' && s[i] !== '\n' && s[i] !== '\r' && s[i] !== '\t') i++;
+        while (
+            i < s.length &&
+            s[i] !== '=' &&
+            s[i] !== ' ' &&
+            s[i] !== '\n' &&
+            s[i] !== '\r' &&
+            s[i] !== '\t'
+        )
+            i++;
         /* v8 ignore next */
         if (i > nameStart) {
             out.push(`<span class="xml-attr-name">${esc(s.slice(nameStart, i))}</span>`);
@@ -240,7 +246,10 @@ export function highlightXml(xml: string): string {
         if (xml.startsWith('<?', i)) {
             const end = xml.indexOf('?>', i);
             /* v8 ignore next */
-            if (end === -1) { out.push(esc(xml.slice(i))); break; }
+            if (end === -1) {
+                out.push(esc(xml.slice(i)));
+                break;
+            }
             out.push(`<span class="xml-prolog">${esc(xml.slice(i, end + 2))}</span>`);
             i = end + 2;
             continue;
@@ -250,7 +259,10 @@ export function highlightXml(xml: string): string {
         if (xml.startsWith('<!--', i)) {
             const end = xml.indexOf('-->', i);
             /* v8 ignore next */
-            if (end === -1) { out.push(esc(xml.slice(i))); break; }
+            if (end === -1) {
+                out.push(esc(xml.slice(i)));
+                break;
+            }
             out.push(`<span class="xml-comment">${esc(xml.slice(i, end + 3))}</span>`);
             i = end + 3;
             continue;
@@ -260,9 +272,14 @@ export function highlightXml(xml: string): string {
         if (xml.startsWith('</', i)) {
             const end = xml.indexOf('>', i);
             /* v8 ignore next */
-            if (end === -1) { out.push(esc(xml.slice(i))); break; }
+            if (end === -1) {
+                out.push(esc(xml.slice(i)));
+                break;
+            }
             const name = xml.slice(i + 2, end).trim();
-            out.push(`<span class="xml-punct">&lt;/</span>${elSpan(name)}<span class="xml-punct">&gt;</span>`);
+            out.push(
+                `<span class="xml-punct">&lt;/</span>${elSpan(name)}<span class="xml-punct">&gt;</span>`
+            );
             i = end + 1;
             continue;
         }
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 214fe45..656eabc 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -94,10 +94,22 @@
     </main>
 
     <footer class="px-6 py-4">
-        <div class="mx-auto flex max-w-5xl flex-col items-center gap-y-1 text-[10px] text-neutral-400 dark:text-neutral-600">
-            <span>Made with ♥ by <a href="https://kellenmurphy.com" class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400">The SAML Guy</a></span>
+        <div
+            class="mx-auto flex max-w-5xl flex-col items-center gap-y-1 text-[10px] text-neutral-400 dark:text-neutral-600"
+        >
+            <span
+                >Made with ♥ by <a
+                    href="https://kellenmurphy.com"
+                    class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
+                    >The SAML Guy</a
+                ></span
+            >
             <div class="flex items-center gap-x-3">
-                <a href="/privacy" class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400">Privacy</a>
+                <a
+                    href="/privacy"
+                    class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
+                    >Privacy</a
+                >
                 <span aria-hidden="true">&middot;</span>
                 <a
                     href="https://github.com/kellenmurphy/samlguy/security"
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index 21b2302..ed2286c 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -1,7 +1,25 @@
 <script lang="ts">
     import { onMount } from 'svelte';
-    import { decodeSaml, decodeAllSaml, prettyPrintXml, type SamlDecodeResult, AUTHN_CONTEXT_LABELS, AUTHN_CONTEXT_SPEC_URLS, STATUS_DESCRIPTIONS, STATUS_SPEC_URLS } from '$lib/saml';
-    import { isMetadata, parseMetadata, entityCategoryKind, type MetadataResult, type EntityCategoryKind, BINDING_LABELS, ENTITY_CATEGORY_LABELS, ENTITY_CATEGORY_SPEC_URLS } from '$lib/metadata';
+    import {
+        decodeSaml,
+        decodeAllSaml,
+        prettyPrintXml,
+        type SamlDecodeResult,
+        AUTHN_CONTEXT_LABELS,
+        AUTHN_CONTEXT_SPEC_URLS,
+        STATUS_DESCRIPTIONS,
+        STATUS_SPEC_URLS
+    } from '$lib/saml';
+    import {
+        isMetadata,
+        parseMetadata,
+        entityCategoryKind,
+        type MetadataResult,
+        type EntityCategoryKind,
+        BINDING_LABELS,
+        ENTITY_CATEGORY_LABELS,
+        ENTITY_CATEGORY_SPEC_URLS
+    } from '$lib/metadata';
     import { checkMetadata, type MetadataCheck, type CheckSeverity } from '$lib/metadata-checks';
     import { decodeJwt, type JwtDecodeResult } from '$lib/jwt';
     import { decodeAllGeneric, type GenericDecodeResult } from '$lib/generic';
@@ -75,7 +93,9 @@
     }
 
     const detected = $derived(detect(input));
-    const hasResults = $derived(!!(results.length || genericResults.length || jwtResult || metadataResult));
+    const hasResults = $derived(
+        !!(results.length || genericResults.length || jwtResult || metadataResult)
+    );
 
     onMount(() => {
         const hash = window.location.hash.slice(1);
@@ -257,10 +277,16 @@
 
     function handleXmlMouseover(e: MouseEvent) {
         const target = (e.target as Element).closest('[data-el]');
-        if (!target) { xmlTip = null; return; }
+        if (!target) {
+            xmlTip = null;
+            return;
+        }
         const local = target.getAttribute('data-el')!;
         const tip = XML_ELEMENT_TIPS[local];
-        if (!tip) { xmlTip = null; return; }
+        if (!tip) {
+            xmlTip = null;
+            return;
+        }
         const rect = target.getBoundingClientRect();
         xmlTip = { el: local, text: tip, x: rect.left, y: rect.bottom + 6 };
     }
@@ -389,7 +415,8 @@
         <div>
             <h1 class="text-2xl font-bold">Identity Decoder</h1>
             <p class="mt-1 text-sm text-neutral-600 dark:text-neutral-400">
-                Paste a SAML assertion, JWT, query string, URL, or HTTP log line. We'll figure it out and try to explain it!
+                Paste a SAML assertion, JWT, query string, URL, or HTTP log line. We'll figure it
+                out and try to explain it!
             </p>
         </div>
         <div bind:this={examplesRef} class="relative flex shrink-0 items-center gap-2">
@@ -416,18 +443,27 @@
                 <button
                     onclick={copyLink}
                     class="rounded-md px-3 py-1.5 text-sm text-neutral-500 ring-1 ring-neutral-300 transition-colors hover:bg-neutral-100 hover:text-neutral-700 dark:ring-neutral-700 dark:hover:bg-neutral-800 dark:hover:text-neutral-300"
-                >{linkCopied ? 'Copied!' : 'Copy link'}</button>
+                    >{linkCopied ? 'Copied!' : 'Copy link'}</button
+                >
             {/if}
             {#if showExamples}
-                <div class="absolute right-0 top-full z-20 mt-1 min-w-60 overflow-hidden rounded-lg border border-neutral-200 bg-white shadow-lg dark:border-neutral-700 dark:bg-neutral-900">
+                <div
+                    class="absolute right-0 top-full z-20 mt-1 min-w-60 overflow-hidden rounded-lg border border-neutral-200 bg-white shadow-lg dark:border-neutral-700 dark:bg-neutral-900"
+                >
                     {#each EXAMPLE_CATEGORIES as category, i (category)}
                         {@const catExamples = EXAMPLES.filter((e) => e.category === category)}
                         {#if catExamples.length > 0}
                             {#if i > 0}
-                                <div class="border-t border-neutral-100 dark:border-neutral-800"></div>
+                                <div
+                                    class="border-t border-neutral-100 dark:border-neutral-800"
+                                ></div>
                             {/if}
                             <div class="px-3 pb-0.5 pt-2">
-                                <p class="text-xs font-semibold uppercase tracking-wider text-neutral-400 dark:text-neutral-500">{category}</p>
+                                <p
+                                    class="text-xs font-semibold uppercase tracking-wider text-neutral-400 dark:text-neutral-500"
+                                >
+                                    {category}
+                                </p>
                             </div>
                             {#each catExamples as example (example.label)}
                                 <button
@@ -436,7 +472,8 @@
                                         showExamples = false;
                                     }}
                                     class="block w-full px-3 py-1.5 text-left text-sm text-neutral-700 hover:bg-neutral-50 dark:text-neutral-300 dark:hover:bg-neutral-800"
-                                >{example.label}</button>
+                                    >{example.label}</button
+                                >
                             {/each}
                             <div class="pb-1"></div>
                         {/if}
@@ -478,11 +515,12 @@
         {@const iss = typeof jwtResult.payload.iss === 'string' ? jwtResult.payload.iss : null}
         {@const sub = typeof jwtResult.payload.sub === 'string' ? jwtResult.payload.sub : null}
         {@const jti = typeof jwtResult.payload.jti === 'string' ? jwtResult.payload.jti : null}
-        {@const audArr = jwtResult.payload.aud !== undefined
-            ? Array.isArray(jwtResult.payload.aud)
-                ? jwtResult.payload.aud
-                : [jwtResult.payload.aud]
-            : null}
+        {@const audArr =
+            jwtResult.payload.aud !== undefined
+                ? Array.isArray(jwtResult.payload.aud)
+                    ? jwtResult.payload.aud
+                    : [jwtResult.payload.aud]
+                : null}
         {@const hasTimestamps = !!(
             jwtResult.timestamps.iat ||
             jwtResult.timestamps.exp ||
@@ -496,8 +534,8 @@
                     : 'border-amber-300 bg-amber-50 text-amber-700 dark:border-amber-800 dark:bg-amber-950/30 dark:text-amber-400'}"
             >
                 {#if jwtResult.isAlgNone}
-                    <strong>Dangerous:</strong> <code>alg: none</code> — this token has no signature
-                    and cannot be trusted.
+                    <strong>Dangerous:</strong> <code>alg: none</code> — this token has no signature and
+                    cannot be trusted.
                 {:else}
                     <strong>Weak algorithm:</strong>
                     <code>{alg}</code> uses a shared secret (HMAC). Signature cannot be verified without
@@ -517,7 +555,9 @@
             </div>
             <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Algorithm<InfoTip key="jwt.algorithm" /></dt>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Algorithm<InfoTip key="jwt.algorithm" />
+                    </dt>
                     <dd class="flex flex-wrap items-center gap-2">
                         <span
                             class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
@@ -539,47 +579,70 @@
                 </div>
                 {#if typ}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Type<InfoTip key="jwt.tokenType" /></dt>
-                        <dd class="font-mono text-sm text-neutral-900 dark:text-neutral-100">{typ}</dd>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Type<InfoTip key="jwt.tokenType" />
+                        </dt>
+                        <dd class="font-mono text-sm text-neutral-900 dark:text-neutral-100">
+                            {typ}
+                        </dd>
                     </div>
                 {/if}
                 {#if kid}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Key ID<InfoTip key="jwt.keyId" /></dt>
-                        <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
-                            >{kid}</dd
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Key ID<InfoTip key="jwt.keyId" />
+                        </dt>
+                        <dd
+                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
+                            {kid}
+                        </dd>
                     </div>
                 {/if}
                 {#if iss}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Issuer<InfoTip key="jwt.issuer" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Issuer<InfoTip key="jwt.issuer" />
+                        </dt>
                         <dd class="flex flex-wrap items-center gap-3">
-                            <span class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{iss}</span>
+                            <span
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                >{iss}</span
+                            >
                             {#if !discoveryResult && !discoveryLoading}
                                 <button
                                     onclick={fetchDiscovery}
                                     class="shrink-0 rounded px-2 py-0.5 text-xs text-neutral-400 ring-1 ring-neutral-300 transition-colors hover:bg-neutral-100 hover:text-neutral-600 dark:ring-neutral-700 dark:hover:bg-neutral-800 dark:hover:text-neutral-300"
-                                >Discover</button>
+                                    >Discover</button
+                                >
                             {:else if discoveryLoading}
                                 <span class="shrink-0 text-xs text-neutral-400">Fetching…</span>
                             {:else if discoveryResult}
-                                <span class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400">Discovered</span>
+                                <span
+                                    class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400"
+                                    >Discovered</span
+                                >
                             {/if}
                         </dd>
                     </div>
                 {/if}
                 {#if sub}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Subject<InfoTip key="jwt.subject" /></dt>
-                        <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
-                            >{sub}</dd
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Subject<InfoTip key="jwt.subject" />
+                        </dt>
+                        <dd
+                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
+                            {sub}
+                        </dd>
                     </div>
                 {/if}
                 {#if audArr}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Audience<InfoTip key="jwt.audience" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Audience<InfoTip key="jwt.audience" />
+                        </dt>
                         <dd class="flex flex-col gap-0.5">
                             {#each audArr as aud, audIdx (audIdx)}
                                 <span
@@ -592,10 +655,14 @@
                 {/if}
                 {#if jti}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">JWT ID<InfoTip key="jwt.jwtId" /></dt>
-                        <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
-                            >{jti}</dd
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            JWT ID<InfoTip key="jwt.jwtId" />
+                        </dt>
+                        <dd
+                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
+                            {jti}
+                        </dd>
                     </div>
                 {/if}
             </dl>
@@ -615,7 +682,9 @@
                     {#if jwtResult.timestamps.iat}
                         {@const ts = jwtResult.timestamps.iat}
                         <div class="flex flex-wrap items-baseline gap-x-4 gap-y-1 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Issued At<InfoTip key="jwt.ts.issuedAt" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Issued At<InfoTip key="jwt.ts.issuedAt" />
+                            </dt>
                             <dd class="flex flex-wrap items-baseline gap-3">
                                 <span
                                     class="font-mono text-sm text-neutral-900 dark:text-neutral-100"
@@ -632,7 +701,9 @@
                     {#if jwtResult.timestamps.nbf}
                         {@const ts = jwtResult.timestamps.nbf}
                         <div class="flex flex-wrap items-baseline gap-x-4 gap-y-1 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Not Before<InfoTip key="jwt.ts.notBefore" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Not Before<InfoTip key="jwt.ts.notBefore" />
+                            </dt>
                             <dd class="flex flex-wrap items-baseline gap-3">
                                 <span
                                     class="font-mono text-sm text-neutral-900 dark:text-neutral-100"
@@ -649,7 +720,9 @@
                     {#if jwtResult.timestamps.exp}
                         {@const ts = jwtResult.timestamps.exp}
                         <div class="flex flex-wrap items-baseline gap-x-4 gap-y-1 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Expires<InfoTip key="jwt.ts.expires" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Expires<InfoTip key="jwt.ts.expires" />
+                            </dt>
                             <dd class="flex flex-wrap items-baseline gap-3">
                                 <span
                                     class="font-mono text-sm text-neutral-900 dark:text-neutral-100"
@@ -700,59 +773,124 @@
 
         <!-- Discovery results -->
         {#if discoveryResult}
-            {@const jwksUri = safeHref(typeof discoveryResult.jwks_uri === 'string' ? discoveryResult.jwks_uri : null)}
-            {@const authEp = safeHref(typeof discoveryResult.authorization_endpoint === 'string' ? discoveryResult.authorization_endpoint : null)}
-            {@const tokenEp = safeHref(typeof discoveryResult.token_endpoint === 'string' ? discoveryResult.token_endpoint : null)}
-            {@const userinfoEp = safeHref(typeof discoveryResult.userinfo_endpoint === 'string' ? discoveryResult.userinfo_endpoint : null)}
-            {@const supportedAlgs = Array.isArray(discoveryResult.id_token_signing_alg_values_supported) ? discoveryResult.id_token_signing_alg_values_supported as string[] : null}
-            {@const acrValues = Array.isArray(discoveryResult.acr_values_supported) ? discoveryResult.acr_values_supported as string[] : null}
+            {@const jwksUri = safeHref(
+                typeof discoveryResult.jwks_uri === 'string' ? discoveryResult.jwks_uri : null
+            )}
+            {@const authEp = safeHref(
+                typeof discoveryResult.authorization_endpoint === 'string'
+                    ? discoveryResult.authorization_endpoint
+                    : null
+            )}
+            {@const tokenEp = safeHref(
+                typeof discoveryResult.token_endpoint === 'string'
+                    ? discoveryResult.token_endpoint
+                    : null
+            )}
+            {@const userinfoEp = safeHref(
+                typeof discoveryResult.userinfo_endpoint === 'string'
+                    ? discoveryResult.userinfo_endpoint
+                    : null
+            )}
+            {@const supportedAlgs = Array.isArray(
+                discoveryResult.id_token_signing_alg_values_supported
+            )
+                ? (discoveryResult.id_token_signing_alg_values_supported as string[])
+                : null}
+            {@const acrValues = Array.isArray(discoveryResult.acr_values_supported)
+                ? (discoveryResult.acr_values_supported as string[])
+                : null}
             <div
                 class="overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 dark:border-neutral-800 dark:bg-neutral-900"
             >
                 <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800">
-                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">OIDC Discovery</span>
+                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                        >OIDC Discovery</span
+                    >
                 </div>
                 <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                     <div class="flex gap-4 px-4 py-2.5">
                         <dt class="w-36 shrink-0 text-sm text-neutral-500">Issuer</dt>
                         <dd class="flex flex-wrap items-center gap-2">
-                            <span class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{typeof discoveryResult.issuer === 'string' ? discoveryResult.issuer : '—'}</span>
+                            <span
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                >{typeof discoveryResult.issuer === 'string'
+                                    ? discoveryResult.issuer
+                                    : '—'}</span
+                            >
                             {#if discoveryIssuerMatch === true}
-                                <span class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400">Matches token</span>
+                                <span
+                                    class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400"
+                                    >Matches token</span
+                                >
                             {:else if discoveryIssuerMatch === false}
-                                <span class="shrink-0 rounded bg-red-100 px-1.5 py-0.5 text-xs font-medium text-red-800 dark:bg-red-900/40 dark:text-red-400">Mismatch</span>
+                                <span
+                                    class="shrink-0 rounded bg-red-100 px-1.5 py-0.5 text-xs font-medium text-red-800 dark:bg-red-900/40 dark:text-red-400"
+                                    >Mismatch</span
+                                >
                             {/if}
                         </dd>
                     </div>
                     {#if jwksUri}
                         <div class="flex gap-4 px-4 py-2.5">
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">JWKS URI</dt>
-                            <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">
-                                <a href={jwksUri} target="_blank" rel="noopener noreferrer" class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{jwksUri}</a>
+                            <dd
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                            >
+                                <a
+                                    href={jwksUri}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                    >{jwksUri}</a
+                                >
                             </dd>
                         </div>
                     {/if}
                     {#if authEp}
                         <div class="flex gap-4 px-4 py-2.5">
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">Auth Endpoint</dt>
-                            <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">
-                                <a href={authEp} target="_blank" rel="noopener noreferrer" class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{authEp}</a>
+                            <dd
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                            >
+                                <a
+                                    href={authEp}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                    >{authEp}</a
+                                >
                             </dd>
                         </div>
                     {/if}
                     {#if tokenEp}
                         <div class="flex gap-4 px-4 py-2.5">
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">Token Endpoint</dt>
-                            <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">
-                                <a href={tokenEp} target="_blank" rel="noopener noreferrer" class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{tokenEp}</a>
+                            <dd
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                            >
+                                <a
+                                    href={tokenEp}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                    >{tokenEp}</a
+                                >
                             </dd>
                         </div>
                     {/if}
                     {#if userinfoEp}
                         <div class="flex gap-4 px-4 py-2.5">
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">UserInfo</dt>
-                            <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">
-                                <a href={userinfoEp} target="_blank" rel="noopener noreferrer" class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{userinfoEp}</a>
+                            <dd
+                                class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                            >
+                                <a
+                                    href={userinfoEp}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                    >{userinfoEp}</a
+                                >
                             </dd>
                         </div>
                     {/if}
@@ -761,10 +899,20 @@
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">ID Token Algs</dt>
                             <dd class="flex flex-wrap gap-1.5">
                                 {#each supportedAlgs as a (a)}
-                                    <span class="rounded px-1.5 py-0.5 font-mono text-xs {a === alg ? (discoveryAlgOk ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400' : 'bg-red-100 text-red-800 dark:bg-red-900/40 dark:text-red-400') : 'bg-neutral-200 text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300'}">{a}</span>
+                                    <span
+                                        class="rounded px-1.5 py-0.5 font-mono text-xs {a === alg
+                                            ? discoveryAlgOk
+                                                ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400'
+                                                : 'bg-red-100 text-red-800 dark:bg-red-900/40 dark:text-red-400'
+                                            : 'bg-neutral-200 text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300'}"
+                                        >{a}</span
+                                    >
                                 {/each}
                                 {#if discoveryAlgOk === false}
-                                    <span class="rounded bg-red-100 px-1.5 py-0.5 text-xs font-medium text-red-800 dark:bg-red-900/40 dark:text-red-400">Token alg not supported</span>
+                                    <span
+                                        class="rounded bg-red-100 px-1.5 py-0.5 text-xs font-medium text-red-800 dark:bg-red-900/40 dark:text-red-400"
+                                        >Token alg not supported</span
+                                    >
                                 {/if}
                             </dd>
                         </div>
@@ -774,7 +922,10 @@
                             <dt class="w-36 shrink-0 text-sm text-neutral-500">ACR Values</dt>
                             <dd class="flex flex-wrap gap-1.5">
                                 {#each acrValues as acr (acr)}
-                                    <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{acr}</span>
+                                    <span
+                                        class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                        >{acr}</span
+                                    >
                                 {/each}
                             </dd>
                         </div>
@@ -840,15 +991,25 @@
                 <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800">
                     <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">
                         Health Checks
-                        <span class="ml-1 font-normal normal-case text-neutral-400">({metadataChecks.length})</span>
+                        <span class="ml-1 font-normal normal-case text-neutral-400"
+                            >({metadataChecks.length})</span
+                        >
                     </span>
                 </div>
                 <ul class="divide-y divide-neutral-100 dark:divide-neutral-800">
                     {#each metadataChecks as chk, chki (chki)}
                         <li class="flex gap-3 px-4 py-2.5">
-                            <span class="mt-0.5 w-16 shrink-0 rounded px-1.5 py-0.5 text-center text-xs font-medium {CHECK_CLASSES[chk.severity]}">{CHECK_LABELS[chk.severity]}</span>
+                            <span
+                                class="mt-0.5 w-16 shrink-0 rounded px-1.5 py-0.5 text-center text-xs font-medium {CHECK_CLASSES[
+                                    chk.severity
+                                ]}">{CHECK_LABELS[chk.severity]}</span
+                            >
                             <div class="min-w-0">
-                                <div class="text-sm font-medium text-neutral-800 dark:text-neutral-200">{chk.title}</div>
+                                <div
+                                    class="text-sm font-medium text-neutral-800 dark:text-neutral-200"
+                                >
+                                    {chk.title}
+                                </div>
                                 <div class="text-xs text-neutral-500">{chk.detail}</div>
                             </div>
                         </li>
@@ -862,18 +1023,29 @@
             class="overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 dark:border-neutral-800 dark:bg-neutral-900"
         >
             <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800">
-                <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">Entity</span>
+                <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                    >Entity</span
+                >
             </div>
             <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Entity ID<InfoTip key="meta.entityId" /></dt>
-                    <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{e.entityId || '—'}</dd>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Entity ID<InfoTip key="meta.entityId" />
+                    </dt>
+                    <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">
+                        {e.entityId || '—'}
+                    </dd>
                 </div>
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Roles<InfoTip key="meta.role" /></dt>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Roles<InfoTip key="meta.role" />
+                    </dt>
                     <dd class="flex flex-wrap gap-1.5">
                         {#each e.roles as role, ri (ri)}
-                            <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{ROLE_LABELS[role.kind]}</span>
+                            <span
+                                class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                >{ROLE_LABELS[role.kind]}</span
+                            >
                         {/each}
                         {#if e.roles.length === 0}
                             <span class="text-sm text-neutral-500">none</span>
@@ -881,59 +1053,110 @@
                     </dd>
                 </div>
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Signature<InfoTip key="meta.signature" /></dt>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Signature<InfoTip key="meta.signature" />
+                    </dt>
                     <dd class="flex flex-wrap items-center gap-2 text-sm">
                         {#if metadataResult.signature}
-                            <span class="rounded bg-sky-100 px-1.5 py-0.5 text-xs font-medium text-sky-800 dark:bg-sky-900/40 dark:text-sky-400">Signed</span>
-                            <span class="font-mono text-xs text-neutral-500">{sigAlgLabel(metadataResult.signature.algorithm)}</span>
+                            <span
+                                class="rounded bg-sky-100 px-1.5 py-0.5 text-xs font-medium text-sky-800 dark:bg-sky-900/40 dark:text-sky-400"
+                                >Signed</span
+                            >
+                            <span class="font-mono text-xs text-neutral-500"
+                                >{sigAlgLabel(metadataResult.signature.algorithm)}</span
+                            >
                             <span class="text-xs text-neutral-400">· not verified</span>
                         {:else}
-                            <span class="rounded bg-neutral-200 px-1.5 py-0.5 text-xs font-medium text-neutral-600 dark:bg-neutral-700 dark:text-neutral-300">Unsigned</span>
+                            <span
+                                class="rounded bg-neutral-200 px-1.5 py-0.5 text-xs font-medium text-neutral-600 dark:bg-neutral-700 dark:text-neutral-300"
+                                >Unsigned</span
+                            >
                         {/if}
                     </dd>
                 </div>
                 {#if e.validUntil}
                     {@const vu = new Date(e.validUntil)}
                     <div class="flex flex-wrap items-baseline gap-x-4 gap-y-1 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Valid until<InfoTip key="meta.validUntil" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Valid until<InfoTip key="meta.validUntil" />
+                        </dt>
                         <dd class="flex flex-wrap items-baseline gap-3">
-                            <span class="font-mono text-sm text-neutral-900 dark:text-neutral-100">{e.validUntil}</span>
+                            <span class="font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                >{e.validUntil}</span
+                            >
                             {#if !isNaN(vu.getTime())}
-                                <span class="text-xs {isExpired(vu) ? 'text-red-600 dark:text-red-400' : 'text-green-700 dark:text-green-400'}">{relativeLabel(vu)}</span>
+                                <span
+                                    class="text-xs {isExpired(vu)
+                                        ? 'text-red-600 dark:text-red-400'
+                                        : 'text-green-700 dark:text-green-400'}"
+                                    >{relativeLabel(vu)}</span
+                                >
                             {/if}
                         </dd>
                     </div>
                 {/if}
                 {#if e.registrationAuthority}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Registrar<InfoTip key="meta.registrationAuthority" /></dt>
-                        <dd class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{e.registrationAuthority}</dd>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Registrar<InfoTip key="meta.registrationAuthority" />
+                        </dt>
+                        <dd
+                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                        >
+                            {e.registrationAuthority}
+                        </dd>
                     </div>
                 {/if}
                 {#if e.entityCategories.length > 0}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Categories<InfoTip key="meta.entityCategories" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Categories<InfoTip key="meta.entityCategories" />
+                        </dt>
                         <dd class="flex flex-wrap gap-1.5">
                             {#each e.entityCategories as cat, cati (cati)}
                                 {@const href = categoryHref(cat)}
                                 {#if href}
-                                    <a href={href} target="_blank" rel="noopener noreferrer" title={cat} class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium underline decoration-1 underline-offset-2 opacity-90 hover:opacity-100 {categoryClasses(cat)}">{categoryLabel(cat)}</a>
+                                    <a
+                                        {href}
+                                        target="_blank"
+                                        rel="noopener noreferrer"
+                                        title={cat}
+                                        class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium underline decoration-1 underline-offset-2 opacity-90 hover:opacity-100 {categoryClasses(
+                                            cat
+                                        )}">{categoryLabel(cat)}</a
+                                    >
                                 {:else}
-                                    <span title={cat} class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium {categoryClasses(cat)}">{categoryLabel(cat)}</span>
+                                    <span
+                                        title={cat}
+                                        class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium {categoryClasses(
+                                            cat
+                                        )}">{categoryLabel(cat)}</span
+                                    >
                                 {/if}
                             {/each}
                         </dd>
                     </div>
                 {/if}
                 {#if e.organization}
-                    {@const orgName = e.organization.displayNames[0]?.value ?? e.organization.names[0]?.value}
+                    {@const orgName =
+                        e.organization.displayNames[0]?.value ?? e.organization.names[0]?.value}
                     {@const orgUrl = safeHref(e.organization.urls[0]?.value ?? null)}
                     {#if orgName || orgUrl}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Organization<InfoTip key="meta.organization" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Organization<InfoTip key="meta.organization" />
+                            </dt>
                             <dd class="space-y-0.5 text-sm">
-                                {#if orgName}<div class="text-neutral-900 dark:text-neutral-100">{orgName}</div>{/if}
-                                {#if orgUrl}<a href={orgUrl} target="_blank" rel="noopener noreferrer" class="break-all font-mono text-xs text-neutral-500 underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{orgUrl}</a>{/if}
+                                {#if orgName}<div class="text-neutral-900 dark:text-neutral-100">
+                                        {orgName}
+                                    </div>{/if}
+                                {#if orgUrl}<a
+                                        href={orgUrl}
+                                        target="_blank"
+                                        rel="noopener noreferrer"
+                                        class="break-all font-mono text-xs text-neutral-500 underline decoration-neutral-300 hover:decoration-neutral-500 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                        >{orgUrl}</a
+                                    >{/if}
                             </dd>
                         </div>
                     {/if}
@@ -943,44 +1166,73 @@
 
         <!-- Per-role cards -->
         {#each e.roles as role, ri (ri)}
-            {@const flags = role.kind === 'idp'
-                ? [{ label: 'WantAuthnRequestsSigned', val: role.wantAuthnRequestsSigned }]
-                : [{ label: 'AuthnRequestsSigned', val: role.authnRequestsSigned }, { label: 'WantAssertionsSigned', val: role.wantAssertionsSigned }]}
+            {@const flags =
+                role.kind === 'idp'
+                    ? [{ label: 'WantAuthnRequestsSigned', val: role.wantAuthnRequestsSigned }]
+                    : [
+                          { label: 'AuthnRequestsSigned', val: role.authnRequestsSigned },
+                          { label: 'WantAssertionsSigned', val: role.wantAssertionsSigned }
+                      ]}
             {@const definedFlags = flags.filter((f) => f.val !== undefined)}
             <div
                 class="overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 dark:border-neutral-800 dark:bg-neutral-900"
             >
-                <div class="flex flex-wrap items-baseline gap-2 border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800">
-                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">{ROLE_LABELS[role.kind]}</span>
+                <div
+                    class="flex flex-wrap items-baseline gap-2 border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800"
+                >
+                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                        >{ROLE_LABELS[role.kind]}</span
+                    >
                     {#if role.mdui?.displayNames[0]?.value}
-                        <span class="text-xs text-neutral-400">{role.mdui.displayNames[0].value}</span>
+                        <span class="text-xs text-neutral-400"
+                            >{role.mdui.displayNames[0].value}</span
+                        >
                     {/if}
                 </div>
                 <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                     {#if role.mdui?.descriptions[0]?.value}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Description<InfoTip key="meta.mdui" /></dt>
-                            <dd class="text-sm text-neutral-700 dark:text-neutral-300">{role.mdui.descriptions[0].value}</dd>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Description<InfoTip key="meta.mdui" />
+                            </dt>
+                            <dd class="text-sm text-neutral-700 dark:text-neutral-300">
+                                {role.mdui.descriptions[0].value}
+                            </dd>
                         </div>
                     {/if}
                     {#if definedFlags.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Signing<InfoTip key="meta.signingFlags" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Signing<InfoTip key="meta.signingFlags" />
+                            </dt>
                             <dd class="flex flex-wrap gap-1.5">
                                 {#each definedFlags as f (f.label)}
-                                    <span class="rounded px-1.5 py-0.5 font-mono text-xs {f.val ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400' : 'bg-neutral-200 text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300'}">{f.label}: {f.val ? 'yes' : 'no'}</span>
+                                    <span
+                                        class="rounded px-1.5 py-0.5 font-mono text-xs {f.val
+                                            ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400'
+                                            : 'bg-neutral-200 text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300'}"
+                                        >{f.label}: {f.val ? 'yes' : 'no'}</span
+                                    >
                                 {/each}
                             </dd>
                         </div>
                     {/if}
                     {#if role.singleSignOnServices && role.singleSignOnServices.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">SSO<InfoTip key="meta.sso" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                SSO<InfoTip key="meta.sso" />
+                            </dt>
                             <dd class="space-y-1.5">
                                 {#each role.singleSignOnServices as ep, ei (ei)}
                                     <div class="flex flex-wrap items-baseline gap-2">
-                                        <span class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{bindingLabel(ep.binding)}</span>
-                                        <span class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{ep.location}</span>
+                                        <span
+                                            class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                            >{bindingLabel(ep.binding)}</span
+                                        >
+                                        <span
+                                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                            >{ep.location}</span
+                                        >
                                     </div>
                                 {/each}
                             </dd>
@@ -988,14 +1240,28 @@
                     {/if}
                     {#if role.assertionConsumerServices && role.assertionConsumerServices.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">ACS<InfoTip key="meta.acs" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                ACS<InfoTip key="meta.acs" />
+                            </dt>
                             <dd class="space-y-1.5">
                                 {#each role.assertionConsumerServices as ep, ei (ei)}
                                     <div class="flex flex-wrap items-baseline gap-2">
-                                        {#if ep.index !== undefined}<span class="shrink-0 font-mono text-xs text-neutral-400">[{ep.index}]</span>{/if}
-                                        <span class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{bindingLabel(ep.binding)}</span>
-                                        {#if ep.isDefault}<span class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400">default</span>{/if}
-                                        <span class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{ep.location}</span>
+                                        {#if ep.index !== undefined}<span
+                                                class="shrink-0 font-mono text-xs text-neutral-400"
+                                                >[{ep.index}]</span
+                                            >{/if}
+                                        <span
+                                            class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                            >{bindingLabel(ep.binding)}</span
+                                        >
+                                        {#if ep.isDefault}<span
+                                                class="shrink-0 rounded bg-green-100 px-1.5 py-0.5 text-xs font-medium text-green-800 dark:bg-green-900/40 dark:text-green-400"
+                                                >default</span
+                                            >{/if}
+                                        <span
+                                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                            >{ep.location}</span
+                                        >
                                     </div>
                                 {/each}
                             </dd>
@@ -1003,12 +1269,20 @@
                     {/if}
                     {#if role.singleLogoutServices.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">SLO<InfoTip key="meta.slo" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                SLO<InfoTip key="meta.slo" />
+                            </dt>
                             <dd class="space-y-1.5">
                                 {#each role.singleLogoutServices as ep, ei (ei)}
                                     <div class="flex flex-wrap items-baseline gap-2">
-                                        <span class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{bindingLabel(ep.binding)}</span>
-                                        <span class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100">{ep.location}</span>
+                                        <span
+                                            class="shrink-0 rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                            >{bindingLabel(ep.binding)}</span
+                                        >
+                                        <span
+                                            class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
+                                            >{ep.location}</span
+                                        >
                                     </div>
                                 {/each}
                             </dd>
@@ -1016,20 +1290,31 @@
                     {/if}
                     {#if role.scopes && role.scopes.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">Scope<InfoTip key="meta.scope" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                Scope<InfoTip key="meta.scope" />
+                            </dt>
                             <dd class="flex flex-wrap gap-1.5">
                                 {#each role.scopes as sc, sci (sci)}
-                                    <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{sc}</span>
+                                    <span
+                                        class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                        >{sc}</span
+                                    >
                                 {/each}
                             </dd>
                         </div>
                     {/if}
                     {#if role.nameIdFormats.length > 0}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">NameID formats<InfoTip key="meta.nameIdFormats" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                NameID formats<InfoTip key="meta.nameIdFormats" />
+                            </dt>
                             <dd class="flex flex-wrap gap-1.5">
                                 {#each role.nameIdFormats as f, fi (fi)}
-                                    <span title={f} class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{shortFormat(f)}</span>
+                                    <span
+                                        title={f}
+                                        class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                        >{shortFormat(f)}</span
+                                    >
                                 {/each}
                             </dd>
                         </div>
@@ -1037,21 +1322,48 @@
                     {#each role.keys as k, ki (ki)}
                         {@const c = certInfos[k.certificate.slice(0, 20)]}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">{k.use === 'encryption' ? 'Encryption cert' : k.use === 'signing' ? 'Signing cert' : 'Certificate'}<InfoTip key="meta.keys" /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                {k.use === 'encryption'
+                                    ? 'Encryption cert'
+                                    : k.use === 'signing'
+                                      ? 'Signing cert'
+                                      : 'Certificate'}<InfoTip key="meta.keys" />
+                            </dt>
                             <dd class="space-y-1.5">
                                 {#if c === false}
-                                    <span class="text-sm text-neutral-500">present (could not decode)</span>
+                                    <span class="text-sm text-neutral-500"
+                                        >present (could not decode)</span
+                                    >
                                 {:else if c}
                                     <div class="flex flex-wrap gap-2">
-                                        <span class="rounded px-1.5 py-0.5 font-mono text-xs {c.isValid ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400' : 'bg-red-100 text-red-800 dark:bg-red-900/40 dark:text-red-400'}">{c.isValid ? 'Valid' : 'Expired'}</span>
-                                        <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">{c.keyAlgorithm}</span>
+                                        <span
+                                            class="rounded px-1.5 py-0.5 font-mono text-xs {c.isValid
+                                                ? 'bg-green-100 text-green-800 dark:bg-green-900/40 dark:text-green-400'
+                                                : 'bg-red-100 text-red-800 dark:bg-red-900/40 dark:text-red-400'}"
+                                            >{c.isValid ? 'Valid' : 'Expired'}</span
+                                        >
+                                        <span
+                                            class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                            >{c.keyAlgorithm}</span
+                                        >
+                                    </div>
+                                    <div
+                                        class="font-mono text-xs text-neutral-700 dark:text-neutral-300"
+                                    >
+                                        {c.subject}
+                                    </div>
+                                    <div class="font-mono text-xs text-neutral-500">
+                                        Issuer: {c.issuer}
                                     </div>
-                                    <div class="font-mono text-xs text-neutral-700 dark:text-neutral-300">{c.subject}</div>
-                                    <div class="font-mono text-xs text-neutral-500">Issuer: {c.issuer}</div>
                                     <div class="text-xs text-neutral-500">
                                         {c.validFrom.toISOString().slice(0, 10)} →
                                         {c.validTo.toISOString().slice(0, 10)}
-                                        <span class="ml-1 {isExpired(c.validTo) ? 'text-red-600 dark:text-red-400' : 'text-green-700 dark:text-green-400'}">({relativeLabel(c.validTo)})</span>
+                                        <span
+                                            class="ml-1 {isExpired(c.validTo)
+                                                ? 'text-red-600 dark:text-red-400'
+                                                : 'text-green-700 dark:text-green-400'}"
+                                            >({relativeLabel(c.validTo)})</span
+                                        >
                                     </div>
                                 {:else}
                                     <span class="text-sm text-neutral-500">decoding…</span>
@@ -1064,36 +1376,62 @@
                 {#if role.requestedAttributes && role.requestedAttributes.length > 0}
                     <div class="border-t border-neutral-200 dark:border-neutral-800">
                         <div class="px-4 py-2.5">
-                            <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">
+                            <span
+                                class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                            >
                                 Requested Attributes<InfoTip key="meta.requestedAttributes" />
-                                <span class="ml-1 font-normal normal-case text-neutral-400">({role.requestedAttributes.length})</span>
+                                <span class="ml-1 font-normal normal-case text-neutral-400"
+                                    >({role.requestedAttributes.length})</span
+                                >
                             </span>
                         </div>
                         <div class="overflow-x-auto">
                             <table class="w-full text-sm">
                                 <thead>
                                     <tr class="border-y border-neutral-200 dark:border-neutral-800">
-                                        <th class="px-4 py-2 text-left text-xs font-medium text-neutral-500">Name</th>
-                                        <th class="px-4 py-2 text-left text-xs font-medium text-neutral-500">Friendly Name</th>
-                                        <th class="px-4 py-2 text-left text-xs font-medium text-neutral-500">Required</th>
+                                        <th
+                                            class="px-4 py-2 text-left text-xs font-medium text-neutral-500"
+                                            >Name</th
+                                        >
+                                        <th
+                                            class="px-4 py-2 text-left text-xs font-medium text-neutral-500"
+                                            >Friendly Name</th
+                                        >
+                                        <th
+                                            class="px-4 py-2 text-left text-xs font-medium text-neutral-500"
+                                            >Required</th
+                                        >
                                     </tr>
                                 </thead>
                                 <tbody class="divide-y divide-neutral-100 dark:divide-neutral-800">
                                     {#each role.requestedAttributes as ra, rai (rai)}
                                         {@const raInfo = getAttributeInfo(ra.name)}
                                         <tr>
-                                            <td class="px-4 py-2 text-xs text-neutral-700 dark:text-neutral-300">
-                                                <div class="whitespace-nowrap font-mono">{ra.name}</div>
+                                            <td
+                                                class="px-4 py-2 text-xs text-neutral-700 dark:text-neutral-300"
+                                            >
+                                                <div class="whitespace-nowrap font-mono">
+                                                    {ra.name}
+                                                </div>
                                                 {#if raInfo?.categories.includes('rs')}
                                                     <div class="mt-1 flex flex-wrap gap-1">
-                                                        <span class="inline-flex items-center rounded bg-emerald-100 px-1.5 py-0.5 text-xs font-medium text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-400" title="REFEDS Research & Scholarship attribute bundle">R&amp;S</span>
+                                                        <span
+                                                            class="inline-flex items-center rounded bg-emerald-100 px-1.5 py-0.5 text-xs font-medium text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-400"
+                                                            title="REFEDS Research & Scholarship attribute bundle"
+                                                            >R&amp;S</span
+                                                        >
                                                     </div>
                                                 {/if}
                                             </td>
-                                            <td class="px-4 py-2 text-xs text-neutral-500">{ra.friendlyName ?? raInfo?.friendlyName ?? ''}</td>
+                                            <td class="px-4 py-2 text-xs text-neutral-500"
+                                                >{ra.friendlyName ?? raInfo?.friendlyName ?? ''}</td
+                                            >
                                             <td class="px-4 py-2 text-xs">
                                                 {#if ra.isRequired}
-                                                    <span class="rounded bg-amber-100 px-1.5 py-0.5 text-xs font-medium text-amber-800 dark:bg-amber-900/40 dark:text-amber-400">required</span>
+                                                    <span
+                                                        class="rounded bg-amber-100 px-1.5 py-0.5 text-xs font-medium text-amber-800 dark:bg-amber-900/40 dark:text-amber-400"
+                                                        >required</span
+                                                    >
                                                 {:else}
                                                     <span class="text-neutral-400">optional</span>
                                                 {/if}
@@ -1114,18 +1452,30 @@
                 class="overflow-hidden rounded-lg border border-neutral-200 bg-neutral-50 dark:border-neutral-800 dark:bg-neutral-900"
             >
                 <div class="border-b border-neutral-200 px-4 py-2.5 dark:border-neutral-800">
-                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">Contacts<InfoTip key="meta.contacts" /></span>
+                    <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                        >Contacts<InfoTip key="meta.contacts" /></span
+                    >
                 </div>
                 <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                     {#each e.contacts as c, ci (ci)}
                         {@const name = [c.givenName, c.surName].filter(Boolean).join(' ')}
                         <div class="flex gap-4 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm capitalize text-neutral-500">{c.type || 'contact'}</dt>
+                            <dt class="w-36 shrink-0 text-sm capitalize text-neutral-500">
+                                {c.type || 'contact'}
+                            </dt>
                             <dd class="space-y-0.5 text-sm">
-                                {#if name}<div class="text-neutral-900 dark:text-neutral-100">{name}</div>{/if}
+                                {#if name}<div class="text-neutral-900 dark:text-neutral-100">
+                                        {name}
+                                    </div>{/if}
                                 {#if c.company}<div class="text-neutral-500">{c.company}</div>{/if}
                                 {#each c.emails as em, emi (emi)}
-                                    <div><a href={`mailto:${em}`} class="font-mono text-xs text-neutral-700 underline decoration-neutral-300 hover:decoration-neutral-500 dark:text-neutral-300 dark:decoration-neutral-600 dark:hover:decoration-neutral-400">{em}</a></div>
+                                    <div>
+                                        <a
+                                            href={`mailto:${em}`}
+                                            class="font-mono text-xs text-neutral-700 underline decoration-neutral-300 hover:decoration-neutral-500 dark:text-neutral-300 dark:decoration-neutral-600 dark:hover:decoration-neutral-400"
+                                            >{em}</a
+                                        >
+                                    </div>
                                 {/each}
                             </dd>
                         </div>
@@ -1137,7 +1487,9 @@
         <!-- XML -->
         <div>
             <div class="mb-2 flex items-center justify-between">
-                <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500">XML</span>
+                <span class="text-xs font-semibold uppercase tracking-wider text-neutral-500"
+                    >XML</span
+                >
                 <button
                     onclick={copyMetadataXml}
                     class="rounded px-2.5 py-1 text-xs text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-neutral-700 dark:hover:bg-neutral-800 dark:hover:text-neutral-300"
@@ -1149,8 +1501,7 @@
             <pre
                 class="overflow-x-auto rounded-lg border border-neutral-200 bg-neutral-50 p-4 font-mono text-xs leading-relaxed text-neutral-800 dark:border-neutral-800 dark:bg-neutral-900 dark:text-neutral-300"
                 onmouseover={handleXmlMouseover}
-                onmouseleave={handleXmlMouseleave}
-            >{@html highlightXml(metadataXml)}</pre>
+                onmouseleave={handleXmlMouseleave}>{@html highlightXml(metadataXml)}</pre>
             <!-- eslint-enable svelte/no-at-html-tags -->
         </div>
     {/if}
@@ -1235,7 +1586,9 @@
             </div>
             <dl class="divide-y divide-neutral-100 dark:divide-neutral-800">
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Binding<InfoTip key="saml.binding" /></dt>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Binding<InfoTip key="saml.binding" />
+                    </dt>
                     <dd class="text-sm">
                         <span
                             class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
@@ -1245,7 +1598,9 @@
                     </dd>
                 </div>
                 <div class="flex gap-4 px-4 py-2.5">
-                    <dt class="w-36 shrink-0 text-sm text-neutral-500">Message<InfoTip key="saml.messageType" /></dt>
+                    <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                        Message<InfoTip key="saml.messageType" />
+                    </dt>
                     <dd class="text-sm">
                         <span
                             class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
@@ -1256,7 +1611,9 @@
                 </div>
                 {#if s.status}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Status<InfoTip key="saml.status" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Status<InfoTip key="saml.status" />
+                        </dt>
                         <dd class="flex flex-col gap-1">
                             <div class="flex flex-wrap items-baseline gap-2">
                                 <span
@@ -1291,9 +1648,12 @@
                                 {/if}
                             </div>
                             {#if shortCode(s.status.code) !== 'Success'}
-                                {@const desc = STATUS_DESCRIPTIONS[s.status.subCode ?? s.status.code]}
+                                {@const desc =
+                                    STATUS_DESCRIPTIONS[s.status.subCode ?? s.status.code]}
                                 {#if desc}
-                                    <p class="text-xs text-neutral-400 dark:text-neutral-500">{desc}</p>
+                                    <p class="text-xs text-neutral-400 dark:text-neutral-500">
+                                        {desc}
+                                    </p>
                                 {/if}
                             {/if}
                         </dd>
@@ -1301,7 +1661,9 @@
                 {/if}
                 {#if s.issuer}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Issuer<InfoTip key="saml.issuer" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Issuer<InfoTip key="saml.issuer" />
+                        </dt>
                         <dd
                             class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
@@ -1311,7 +1673,9 @@
                 {/if}
                 {#if s.destination}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Destination<InfoTip key="saml.destination" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Destination<InfoTip key="saml.destination" />
+                        </dt>
                         <dd
                             class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
@@ -1321,7 +1685,9 @@
                 {/if}
                 {#if s.acsUrl}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">ACS URL<InfoTip key="saml.acsUrl" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            ACS URL<InfoTip key="saml.acsUrl" />
+                        </dt>
                         <dd
                             class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
@@ -1331,23 +1697,38 @@
                 {/if}
                 {#if s.requestedAuthnContext?.classRefs.length}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Requested AuthnContext<InfoTip key="saml.requestedAuthnContext" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Requested AuthnContext<InfoTip key="saml.requestedAuthnContext" />
+                        </dt>
                         <dd class="flex flex-col gap-1">
                             <div class="flex flex-wrap items-baseline gap-2">
                                 {#each s.requestedAuthnContext.classRefs as ref (ref)}
-                                    <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">
+                                    <span
+                                        class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                    >
                                         {AUTHN_CONTEXT_LABELS[ref] ?? ref}
                                     </span>
                                 {/each}
-                                <span class="text-xs text-neutral-500">{s.requestedAuthnContext.comparison}</span>
+                                <span class="text-xs text-neutral-500"
+                                    >{s.requestedAuthnContext.comparison}</span
+                                >
                             </div>
                             {#each s.requestedAuthnContext.classRefs as ref (ref)}
                                 {#if ref in AUTHN_CONTEXT_LABELS}
                                     {@const specUrl = AUTHN_CONTEXT_SPEC_URLS[ref] ?? safeHref(ref)}
                                     {#if specUrl}
-                                        <a href={specUrl} target="_blank" rel="noopener noreferrer" class="font-mono text-xs text-neutral-400 break-all transition-colors hover:text-neutral-600 dark:text-neutral-500 dark:hover:text-neutral-300">{ref}</a>
+                                        <a
+                                            href={specUrl}
+                                            target="_blank"
+                                            rel="noopener noreferrer"
+                                            class="font-mono text-xs text-neutral-400 break-all transition-colors hover:text-neutral-600 dark:text-neutral-500 dark:hover:text-neutral-300"
+                                            >{ref}</a
+                                        >
                                     {:else}
-                                        <span class="font-mono text-xs text-neutral-400 dark:text-neutral-500 break-all">{ref}</span>
+                                        <span
+                                            class="font-mono text-xs text-neutral-400 dark:text-neutral-500 break-all"
+                                            >{ref}</span
+                                        >
                                     {/if}
                                 {/if}
                             {/each}
@@ -1356,7 +1737,9 @@
                 {/if}
                 {#if s.nameId}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">NameID<InfoTip key="saml.nameId" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            NameID<InfoTip key="saml.nameId" />
+                        </dt>
                         <dd class="flex flex-wrap items-baseline gap-2">
                             <span class="font-mono text-sm text-neutral-900 dark:text-neutral-100">
                                 {s.nameId.value}
@@ -1369,22 +1752,40 @@
                 {/if}
                 {#if s.authnContext?.classRef}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">AuthnContext<InfoTip key="saml.authnContext" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            AuthnContext<InfoTip key="saml.authnContext" />
+                        </dt>
                         <dd class="flex flex-col gap-1">
                             <div class="flex flex-wrap items-baseline gap-2">
-                                <span class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300">
-                                    {AUTHN_CONTEXT_LABELS[s.authnContext.classRef] ?? s.authnContext.classRef}
+                                <span
+                                    class="rounded bg-neutral-200 px-1.5 py-0.5 font-mono text-xs text-neutral-700 dark:bg-neutral-700 dark:text-neutral-300"
+                                >
+                                    {AUTHN_CONTEXT_LABELS[s.authnContext.classRef] ??
+                                        s.authnContext.classRef}
                                 </span>
                                 {#if s.authnContext.declRef}
-                                    <span class="font-mono text-xs text-neutral-500">{s.authnContext.declRef}</span>
+                                    <span class="font-mono text-xs text-neutral-500"
+                                        >{s.authnContext.declRef}</span
+                                    >
                                 {/if}
                             </div>
                             {#if s.authnContext.classRef in AUTHN_CONTEXT_LABELS}
-                                {@const specUrl = AUTHN_CONTEXT_SPEC_URLS[s.authnContext.classRef] ?? safeHref(s.authnContext.classRef)}
+                                {@const specUrl =
+                                    AUTHN_CONTEXT_SPEC_URLS[s.authnContext.classRef] ??
+                                    safeHref(s.authnContext.classRef)}
                                 {#if specUrl}
-                                    <a href={specUrl} target="_blank" rel="noopener noreferrer" class="font-mono text-xs text-neutral-400 break-all transition-colors hover:text-neutral-600 dark:text-neutral-500 dark:hover:text-neutral-300">{s.authnContext.classRef}</a>
+                                    <a
+                                        href={specUrl}
+                                        target="_blank"
+                                        rel="noopener noreferrer"
+                                        class="font-mono text-xs text-neutral-400 break-all transition-colors hover:text-neutral-600 dark:text-neutral-500 dark:hover:text-neutral-300"
+                                        >{s.authnContext.classRef}</a
+                                    >
                                 {:else}
-                                    <span class="font-mono text-xs text-neutral-400 dark:text-neutral-500 break-all">{s.authnContext.classRef}</span>
+                                    <span
+                                        class="font-mono text-xs text-neutral-400 dark:text-neutral-500 break-all"
+                                        >{s.authnContext.classRef}</span
+                                    >
                                 {/if}
                             {/if}
                         </dd>
@@ -1392,7 +1793,9 @@
                 {/if}
                 {#if s.inResponseTo}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">InResponseTo<InfoTip key="saml.inResponseTo" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            InResponseTo<InfoTip key="saml.inResponseTo" />
+                        </dt>
                         <dd
                             class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
@@ -1402,7 +1805,9 @@
                 {/if}
                 {#if s.relayState}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">RelayState<InfoTip key="saml.relayState" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            RelayState<InfoTip key="saml.relayState" />
+                        </dt>
                         <dd
                             class="break-all font-mono text-sm text-neutral-900 dark:text-neutral-100"
                         >
@@ -1412,7 +1817,9 @@
                 {/if}
                 {#if s.encrypted.assertion || s.encrypted.nameId}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Encrypted<InfoTip key="saml.encrypted" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Encrypted<InfoTip key="saml.encrypted" />
+                        </dt>
                         <dd class="flex flex-wrap gap-2">
                             {#if s.encrypted.assertion}
                                 <span
@@ -1435,7 +1842,9 @@
                     {@const certKey = s.signingCertificate.slice(0, 20)}
                     {@const c = certInfos[certKey]}
                     <div class="flex gap-4 px-4 py-2.5">
-                        <dt class="w-36 shrink-0 text-sm text-neutral-500">Signing cert<InfoTip key="saml.signingCert" /></dt>
+                        <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                            Signing cert<InfoTip key="saml.signingCert" />
+                        </dt>
                         <dd class="space-y-1.5">
                             {#if c === false}
                                 <span class="text-sm text-neutral-500"
@@ -1496,7 +1905,9 @@
                     {#each s.timestamps as ts (ts.label)}
                         {@const expired = isExpired(ts.date)}
                         <div class="flex flex-wrap items-baseline gap-x-4 gap-y-1 px-4 py-2.5">
-                            <dt class="w-36 shrink-0 text-sm text-neutral-500">{ts.label}<InfoTip key={SAML_TS_KEY[ts.label]} /></dt>
+                            <dt class="w-36 shrink-0 text-sm text-neutral-500">
+                                {ts.label}<InfoTip key={SAML_TS_KEY[ts.label]} />
+                            </dt>
                             <dd class="flex flex-wrap items-baseline gap-3">
                                 <span
                                     class="font-mono text-sm text-neutral-900 dark:text-neutral-100"
@@ -1547,28 +1958,38 @@
                         <tbody class="divide-y divide-neutral-100 dark:divide-neutral-800">
                             {#each s.attributes as attribute (attribute.name)}
                                 {@const attrInfo = getAttributeInfo(attribute.name)}
-                                {@const scopedStatus = eppnScopedStatus(attribute.name, attribute.values)}
+                                {@const scopedStatus = eppnScopedStatus(
+                                    attribute.name,
+                                    attribute.values
+                                )}
                                 <tr>
-                                    <td class="px-4 py-2 text-xs text-neutral-700 dark:text-neutral-300">
-                                        <div class="font-mono whitespace-nowrap">{attribute.name}</div>
+                                    <td
+                                        class="px-4 py-2 text-xs text-neutral-700 dark:text-neutral-300"
+                                    >
+                                        <div class="font-mono whitespace-nowrap">
+                                            {attribute.name}
+                                        </div>
                                         {#if (attrInfo?.categories.length ?? 0) > 0 || scopedStatus !== null}
                                             <div class="mt-1 flex flex-wrap gap-1">
                                                 {#if attrInfo?.categories.includes('rs')}
                                                     <span
                                                         class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-400"
                                                         title="REFEDS Research & Scholarship attribute bundle — applies to IdPs and SPs that have registered the R&S entity category in their metadata"
-                                                    >R&amp;S</span>
+                                                        >R&amp;S</span
+                                                    >
                                                 {/if}
                                                 {#if scopedStatus === 'scoped'}
                                                     <span
                                                         class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium bg-violet-100 text-violet-700 dark:bg-violet-900/40 dark:text-violet-400"
                                                         title="Properly scoped ePPN — satisfies REFEDS RAF eppn-unique-no-reassign requirements"
-                                                    >eppn-scoped</span>
+                                                        >eppn-scoped</span
+                                                    >
                                                 {:else if scopedStatus === 'unscoped'}
                                                     <span
                                                         class="inline-flex items-center rounded px-1.5 py-0.5 text-xs font-medium bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-400"
                                                         title="Unscoped ePPN — eduPersonPrincipalName should contain @scope per InCommon requirements"
-                                                    >⚠ unscoped</span>
+                                                        >⚠ unscoped</span
+                                                    >
                                                 {/if}
                                             </div>
                                         {/if}
@@ -1606,8 +2027,7 @@
             <pre
                 class="overflow-x-auto rounded-lg border border-neutral-200 bg-neutral-50 p-4 font-mono text-xs leading-relaxed text-neutral-800 dark:border-neutral-800 dark:bg-neutral-900 dark:text-neutral-300"
                 onmouseover={handleXmlMouseover}
-                onmouseleave={handleXmlMouseleave}
-            >{@html highlightXml(result.xml)}</pre>
+                onmouseleave={handleXmlMouseleave}>{@html highlightXml(result.xml)}</pre>
             <!-- eslint-enable svelte/no-at-html-tags -->
         </div>
     {/each}
@@ -1625,20 +2045,50 @@
 {/if}
 
 <style>
-    :global(.xml-punct) { color: #6b7280; }
-    :global(.xml-el) { color: #60a5fa; }
-    :global(.xml-el-tip) { cursor: help; text-decoration: underline dotted; text-decoration-thickness: 1px; }
-    :global(.xml-attr-name) { color: #34d399; }
-    :global(.xml-attr-val) { color: #fb923c; }
-    :global(.xml-comment) { color: #6b7280; font-style: italic; }
-    :global(.xml-prolog) { color: #9ca3af; font-style: italic; }
-
-    :global(html:not(.dark) .xml-punct) { color: #4b5563; }
-    :global(html:not(.dark) .xml-el) { color: #2563eb; }
-    :global(html:not(.dark) .xml-attr-name) { color: #059669; }
-    :global(html:not(.dark) .xml-attr-val) { color: #ea580c; }
-    :global(html:not(.dark) .xml-comment) { color: #6b7280; }
-    :global(html:not(.dark) .xml-prolog) { color: #9ca3af; }
+    :global(.xml-punct) {
+        color: #6b7280;
+    }
+    :global(.xml-el) {
+        color: #60a5fa;
+    }
+    :global(.xml-el-tip) {
+        cursor: help;
+        text-decoration: underline dotted;
+        text-decoration-thickness: 1px;
+    }
+    :global(.xml-attr-name) {
+        color: #34d399;
+    }
+    :global(.xml-attr-val) {
+        color: #fb923c;
+    }
+    :global(.xml-comment) {
+        color: #6b7280;
+        font-style: italic;
+    }
+    :global(.xml-prolog) {
+        color: #9ca3af;
+        font-style: italic;
+    }
+
+    :global(html:not(.dark) .xml-punct) {
+        color: #4b5563;
+    }
+    :global(html:not(.dark) .xml-el) {
+        color: #2563eb;
+    }
+    :global(html:not(.dark) .xml-attr-name) {
+        color: #059669;
+    }
+    :global(html:not(.dark) .xml-attr-val) {
+        color: #ea580c;
+    }
+    :global(html:not(.dark) .xml-comment) {
+        color: #6b7280;
+    }
+    :global(html:not(.dark) .xml-prolog) {
+        color: #9ca3af;
+    }
 
     .xml-tip {
         position: fixed;
diff --git a/src/routes/api/discover/server.test.ts b/src/routes/api/discover/server.test.ts
index 24c9a16..b52a770 100644
--- a/src/routes/api/discover/server.test.ts
+++ b/src/routes/api/discover/server.test.ts
@@ -34,25 +34,27 @@ describe('GET /api/discover', () => {
     });
 
     it('returns 400 for an invalid issuer URL', async () => {
-        await expect(GET(makeEvent({ issuer: 'not a url' }))).rejects.toMatchObject({ status: 400 });
+        await expect(GET(makeEvent({ issuer: 'not a url' }))).rejects.toMatchObject({
+            status: 400
+        });
     });
 
     it('returns 400 when issuer is not HTTPS', async () => {
-        await expect(
-            GET(makeEvent({ issuer: 'http://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 400 });
+        await expect(GET(makeEvent({ issuer: 'http://idp.example.com' }))).rejects.toMatchObject({
+            status: 400
+        });
     });
 
     it('returns 400 for an IPv6 literal issuer', async () => {
-        await expect(
-            GET(makeEvent({ issuer: 'https://[::1]/' }))
-        ).rejects.toMatchObject({ status: 400 });
+        await expect(GET(makeEvent({ issuer: 'https://[::1]/' }))).rejects.toMatchObject({
+            status: 400
+        });
     });
 
     it('returns 400 for an IPv4 literal issuer', async () => {
-        await expect(
-            GET(makeEvent({ issuer: 'https://169.254.169.254/' }))
-        ).rejects.toMatchObject({ status: 400 });
+        await expect(GET(makeEvent({ issuer: 'https://169.254.169.254/' }))).rejects.toMatchObject({
+            status: 400
+        });
     });
 
     // --- Fetch failures ---
@@ -60,9 +62,9 @@ describe('GET /api/discover', () => {
     it('returns 504 when the discovery fetch times out (AbortError thrown directly)', async () => {
         const abortErr = Object.assign(new Error('aborted'), { name: 'AbortError' });
         vi.mocked(fetch).mockRejectedValue(abortErr);
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 504 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 504
+        });
     });
 
     it('aborts the fetch and returns 504 when the 5-second timer fires', async () => {
@@ -84,16 +86,16 @@ describe('GET /api/discover', () => {
 
     it('returns 502 when the fetch fails for a non-timeout reason (e.g. redirect blocked)', async () => {
         vi.mocked(fetch).mockRejectedValue(new TypeError('redirect mode is set to error'));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     it('passes through non-ok HTTP status from the discovery endpoint', async () => {
         vi.mocked(fetch).mockResolvedValue(new Response(null, { status: 404 }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 404 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 404
+        });
     });
 
     // --- Response size limits ---
@@ -105,47 +107,49 @@ describe('GET /api/discover', () => {
                 headers: { 'content-length': '200000' }
             })
         );
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     it('returns 502 when the response body exceeds the size cap even without Content-Length', async () => {
         const bigBody = 'x'.repeat(100_001);
         vi.mocked(fetch).mockResolvedValue(new Response(bigBody, { status: 200 }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     // --- Response body validation ---
 
     it('returns 502 when the response body is not valid JSON', async () => {
         vi.mocked(fetch).mockResolvedValue(new Response('<html>nope</html>', { status: 200 }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     it('returns 502 when the JSON body is not an object (e.g. a number)', async () => {
         vi.mocked(fetch).mockResolvedValue(new Response('42', { status: 200 }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     it('returns 502 when the JSON body is null', async () => {
         vi.mocked(fetch).mockResolvedValue(new Response('null', { status: 200 }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     it('returns 502 when the JSON object has no issuer field', async () => {
-        vi.mocked(fetch).mockResolvedValue(makeJsonResponse({ token_endpoint: 'https://idp.example.com/token' }));
-        await expect(
-            GET(makeEvent({ issuer: 'https://idp.example.com' }))
-        ).rejects.toMatchObject({ status: 502 });
+        vi.mocked(fetch).mockResolvedValue(
+            makeJsonResponse({ token_endpoint: 'https://idp.example.com/token' })
+        );
+        await expect(GET(makeEvent({ issuer: 'https://idp.example.com' }))).rejects.toMatchObject({
+            status: 502
+        });
     });
 
     // --- Happy path ---
diff --git a/src/routes/privacy/+page.svelte b/src/routes/privacy/+page.svelte
index 202270c..86fcc9c 100644
--- a/src/routes/privacy/+page.svelte
+++ b/src/routes/privacy/+page.svelte
@@ -26,7 +26,8 @@
         </svg>
         <p class="text-sm font-medium text-green-800 dark:text-green-400">
             Everything is processed in your browser. Nothing you paste — SAML assertions, JWTs,
-            certificates, or any other identity data — is ever transmitted to or stored on any server.
+            certificates, or any other identity data — is ever transmitted to or stored on any
+            server.
         </p>
     </div>
 
@@ -36,9 +37,9 @@
                 What this tool does
             </h2>
             <p>
-                samlguy.com hosts a client-side identity decoder. SAML assertions, JWTs, and any other
-                content you paste are decoded entirely within your browser. Nothing you paste is
-                transmitted to or stored on any server.
+                samlguy.com hosts a client-side identity decoder. SAML assertions, JWTs, and any
+                other content you paste are decoded entirely within your browser. Nothing you paste
+                is transmitted to or stored on any server.
             </p>
         </section>
 
@@ -63,8 +64,8 @@
                 fetches the issuer's <code
                     class="rounded bg-neutral-100 px-1 font-mono text-xs dark:bg-neutral-800"
                     >.well-known/openid-configuration</code
-                > endpoint on your behalf to avoid browser CORS restrictions. The proxy forwards the
-                response and does not log or store the issuer URL or the response.
+                > endpoint on your behalf to avoid browser CORS restrictions. The proxy forwards the response
+                and does not log or store the issuer URL or the response.
             </p>
         </section>
 
@@ -81,9 +82,7 @@
         </section>
 
         <section class="space-y-2">
-            <h2 class="text-base font-semibold text-neutral-900 dark:text-neutral-100">
-                Hosting
-            </h2>
+            <h2 class="text-base font-semibold text-neutral-900 dark:text-neutral-100">Hosting</h2>
             <p>
                 This site is served via Cloudflare Pages. Cloudflare may collect standard web server
                 logs (IP address, request path, timestamp) in accordance with their own <a