getPasskeyPrfOutput

Runs one assertion ceremony and returns the passkey’s PRF output.

Import

import { 
function getPasskeyPrfOutput({ rpId, credential: allowCredential, prfSalt, timeout, webAuthnClient, }: getPasskeyPrfOutput.Options): Promise<getPasskeyPrfOutput.Result>
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
getPasskeyPrfOutput } from "@category-labs/mera";

Usage

const { 
const credentialId: string
Credential ID selected by the platform, as canonical unpadded base64url.
credentialId, 
const prfOutput: Uint8Array<ArrayBuffer>
First PRF output from WebAuthn. Always 32 bytes.
prfOutput } = await 
function getPasskeyPrfOutput({ rpId, credential: allowCredential, prfSalt, timeout, webAuthnClient, }: getPasskeyPrfOutput.Options): Promise<getPasskeyPrfOutput.Result>
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
getPasskeyPrfOutput({
  
rpId: string
Relying party ID for the WebAuthn assertion.
rpId: "account.example.com",
});

Parameters

options is a getPasskeyPrfOutput.Options.

options.rpId

Type: string
Required

Relying party ID for the WebAuthn assertion.

options.credential

Type: PasskeyCredentialMetadata
Optional; when omitted, WebAuthn may choose any discoverable credential for the relying party

Credential metadata that restricts the assertion to one passkey: a credentialId in canonical unpadded base64url, plus the transports reported when it was created.

options.prfSalt

Type: Uint8Array
Optional; defaults to mera’s fixed salt

PRF salt as 32 raw bytes. An explicit value supports custom PRF namespaces.

options.timeout

Type: number
Optional; platform defaults apply when omitted

WebAuthn timeout in milliseconds.

options.webAuthnClient

Type: WebAuthnClient
Optional; defaults to the built-in browser client

Client that runs the ceremony. WebAuthnClient covers supplying one for a runtime without navigator.credentials.

Returns

import type { 
function getPasskeyPrfOutput({ rpId, credential: allowCredential, prfSalt, timeout, webAuthnClient, }: getPasskeyPrfOutput.Options): Promise<getPasskeyPrfOutput.Result>
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
getPasskeyPrfOutput } from "@category-labs/mera";

type 
type ReturnType = Promise<getPasskeyPrfOutput.Result>
ReturnType = 
interface Promise<T>
Represents the completion of an asynchronous operation
Promise<
(alias) namespace getPasskeyPrfOutput
import getPasskeyPrfOutput
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
getPasskeyPrfOutput.
type getPasskeyPrfOutput.Result = {
    readonly credentialId: string;
    readonly prfOutput: Uint8Array<ArrayBuffer>;
}
Result of a passkey assertion with the WebAuthn PRF extension.
Result>;

credentialId (string): the selected credential ID as canonical unpadded base64url.
prfOutput (Uint8Array<ArrayBuffer>): the 32-byte PRF output.

When credential is omitted, the result may identify any discoverable credential for the relying party.

Errors

PRF_UNAVAILABLE: the authenticator did not return a usable 32-byte PRF output.
INPUT_INVALID: an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
CRYPTO_UNAVAILABLE: the runtime provides no crypto.getRandomValues.
PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

Notes

When prfSalt is omitted, the default salt is used: sha256("mera.prf.salt.v1"). The salt will not change across library versions, and another implementation can reproduce the output from the same constant.

The assertion requires user verification, and the requirement is not configurable (Passkeys and the PRF extension explains the mechanism).

The WebAuthn challenge is generated internally.