@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.16 → 1.0.0-canary.18

package/.releaserc

@@ -11,6 +11,12 @@
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
+    [
+      "@semantic-release/exec",
+      {
+        "prepareCmd": "pnpm fmt"
+      }
+    ],
     "@semantic-release/npm",
     [
       "@semantic-release/git",

package/CHANGELOG.md

@@ -1,14 +1,31 @@
-# [1.0.0-canary.16](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.15...v1.0.0-canary.16) (2026-05-15)
+# [1.0.0-canary.18](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.17...v1.0.0-canary.18) (2026-06-09)
+
+### Features
 
+- PRF extension support for deterministically derived secrets ([4b5b05a](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/4b5b05ab146e39b191855ccb01fd4aca5ed32819))
+
+# [1.0.0-canary.17](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.16...v1.0.0-canary.17) (2026-05-28)
 
 ### Bug Fixes
 
-* align ios autofill root key flow ([1287f57](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/1287f57952b41829032ef368bad826624375e9a3))
+- allow configurable AAGUID ([d5a8176](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/d5a81765ba150e9873e18875f0ac9f7bc4aede93))
+- **Android:** add NoOp methods for iOS-specific functionality ([e2c64db](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/e2c64db479cda70c7c61b7ab3021b70db949a15b))
+- compile issue ([16b939c](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/16b939cb555e75bd052ce57a41a838810a2770cd))
+
+### Features
+
+- configurable credential requirement ([dc09916](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/dc09916d1ee5c8c9d33e53b57f00171472f4f665))
+- record lastUsedAt/count and fix error handling ([47b40ab](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/47b40abf692c0f7cffee6f2266c66f61f8006a65))
+
+# [1.0.0-canary.16](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.15...v1.0.0-canary.16) (2026-05-15)
+
+### Bug Fixes
 
+- align ios autofill root key flow ([1287f57](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/1287f57952b41829032ef368bad826624375e9a3))
 
 ### Features
 
-* add iOS passkey autofill provider ([9aad8f8](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/9aad8f8ceb2ad54cf53847b60dd6e70d5b2a1f2b))
+- add iOS passkey autofill provider ([9aad8f8](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/9aad8f8ceb2ad54cf53847b60dd6e70d5b2a1f2b))
 
 # [1.0.0-canary.15](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.14...v1.0.0-canary.15) (2026-04-10)
 

package/README.md

@@ -44,6 +44,23 @@ If you are using Expo, you can configure the plugin in your `app.json` or `app.c
 
 - `site`: The URL of your FIDO server (default: `https://debug.liquidauth.com`).
 - `label`: The name of the credential provider as it appears in Android settings (default: `My Credential Provider`).
+- `aaguid`: Optional authenticator AAGUID (UUID string) embedded in attestation responses to identify your authenticator to relying parties. When omitted, iOS uses the module's built-in default and Android uses the all-zero AAGUID emitted by the platform. Set the same value across all your apps (iOS, Android, web) so they present one identity.
+- `biometricRequirement`: Controls which authenticators satisfy passkey user verification. See [Biometric Requirement](#biometric-requirement) below.
+
+#### Biometric Requirement
+
+`biometricRequirement` is an optional string property that controls which authenticators are accepted for user verification during passkey creation and authentication.
+
+| Value                          | Android                                                                                  | iOS                                 |
+| ------------------------------ | ---------------------------------------------------------------------------------------- | ----------------------------------- |
+| `strong`                       | Strong biometric only                                                                    | Biometrics only (passcode rejected) |
+| `strongOrCredential` (default) | Strong biometric or device PIN/pattern/password                                          | Biometrics or device passcode       |
+| `weakOrCredential`             | Weak biometric or device credential (key is **not** crypto-bound — a security trade-off) | Biometrics or device passcode       |
+
+**Notes:**
+
+- Android cannot gate a hardware-backed key on weak biometrics, so `weakOrCredential` stores the key without user-authentication binding and uses the biometric prompt as a UI gate only. Use it only when you accept that trade-off.
+- The default `strongOrCredential` is more permissive than the previous strong-only behavior; integrators upgrading will additionally allow the device credential on Android (iOS behavior is unchanged).
 
 ### Configure for iOS
 

package/android/build.gradle

@@ -46,6 +46,9 @@ android {
   }
   testOptions {
     unitTests.includeAndroidResources = true
+    // Let unmocked android.jar calls (e.g. android.util.Log) return defaults instead of throwing
+    // "Stub!" in JVM unit tests.
+    unitTests.returnDefaultValues = true
   }
   packagingOptions {
     pickFirst '**/libc++_shared.so'

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -22,6 +22,7 @@ import androidx.credentials.provider.ProviderCreateCredentialRequest
 import androidx.credentials.webauthn.AuthenticatorAttestationResponse
 import androidx.credentials.webauthn.FidoPublicKeyCredential
 import androidx.credentials.webauthn.PublicKeyCredentialCreationOptions
+import co.algorand.passkeyautofill.auth.BiometricRequirement
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
 import co.algorand.passkeyautofill.utils.PasskeyUtils
@@ -282,7 +283,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
             val cipherToUse = systemUnlockedCipher ?: run {
                 if (biometricPromptResult != null) {
                     try {
-                        val fallback = credentialRepository.getBiometricCipherForEncryption()
+                        val fallback = credentialRepository.getBiometricCipherForEncryption(this@CreatePasskeyActivity, BiometricRequirement.resolve(this@CreatePasskeyActivity))
                         Log.i(TAG, "Successfully obtained fallback cipher from repository (Single Tap timeout)")
                         fallback
                     } catch (e: Exception) {
@@ -424,6 +425,31 @@ class CreatePasskeyActivity : AppCompatActivity() {
             val clientDataJSONb64 = AndroidBase64.encodeToString(clientDataJSONString.toByteArray(), AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
             respJson.put("clientDataJSON", clientDataJSONb64)
 
+            WebAuthn.configuredAaguid(this@CreatePasskeyActivity)?.let { aaguid ->
+                try {
+                    val patched = WebAuthn.injectAaguid(respJson.getString("attestationObject"), aaguid)
+                    respJson.put("attestationObject", patched)
+                } catch (e: Exception) {
+                    Log.w(TAG, "Failed to inject AAGUID into attestationObject", e)
+                }
+            }
+
+            // WebAuthn `prf` extension (hmac-secret).
+            // On registration we advertise `enabled = true` whenever the RP
+            // asked for the extension, signalling that the credential can be
+            // used as a PRF source on subsequent assertions. We deliberately
+            // do not evaluate salts on create — this matches the behaviour of
+            // most platform authenticators.
+            val requestExtensions = requestJson.optJSONObject("publicKey")?.optJSONObject("extensions")
+                ?: requestJson.optJSONObject("extensions")
+            if (requestExtensions?.has("prf") == true || requestExtensions?.has("prfAlreadyHashed") == true) {
+                val clientExtensionResults = fullJson.optJSONObject("clientExtensionResults") ?: JSONObject()
+                val prfResult = JSONObject().put("enabled", true)
+                clientExtensionResults.put("prf", prfResult)
+                fullJson.put("clientExtensionResults", clientExtensionResults)
+                Log.d(TAG, "Advertised PRF support on registration")
+            }
+
             val createResponse = CreatePublicKeyCredentialResponse(fullJson.toString())
             Log.d(TAG, "CreatePublicKeyCredentialResponse: ${fullJson.toString()}")
             
@@ -447,6 +473,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
     }
 
     private suspend fun biometrics(needsCipher: Boolean): BiometricPrompt.AuthenticationResult? {
+        val requirement = BiometricRequirement.resolve(this)
         return suspendCoroutine { continuation ->
             val biometricPrompt = BiometricPrompt(
                 this,
@@ -465,16 +492,19 @@ class CreatePasskeyActivity : AppCompatActivity() {
                     }
                 }
             )
-            val promptInfo = BiometricPrompt.PromptInfo.Builder()
+            val promptInfoBuilder = BiometricPrompt.PromptInfo.Builder()
                 .setTitle("Create Passkey")
                 .setSubtitle("Authenticate to save your passkey")
-                .setNegativeButtonText("Cancel")
-                .setAllowedAuthenticators(androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG)
-                .build()
-            
-            if (needsCipher) {
+                .setAllowedAuthenticators(requirement.allowedAuthenticators)
+            // A negative button is illegal when DEVICE_CREDENTIAL is allowed; the system shows its own.
+            if (!requirement.allowsDeviceCredential) {
+                promptInfoBuilder.setNegativeButtonText("Cancel")
+            }
+            val promptInfo = promptInfoBuilder.build()
+
+            if (needsCipher && requirement.isCryptoBound) {
                 try {
-                    val cipher = credentialRepository.getBiometricCipherForEncryption()
+                    val cipher = credentialRepository.getBiometricCipherForEncryption(this, requirement)
                     biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
                 } catch (e: Exception) {
                     Log.e(TAG, "Failed to initialize biometric prompt with cipher", e)

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -23,12 +23,14 @@ import androidx.credentials.provider.ProviderGetCredentialRequest
 import androidx.credentials.webauthn.AuthenticatorAssertionResponse
 import androidx.credentials.webauthn.FidoPublicKeyCredential
 import androidx.credentials.webauthn.PublicKeyCredentialRequestOptions
+import co.algorand.passkeyautofill.auth.BiometricRequirement
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
 import co.algorand.passkeyautofill.utils.PasskeyUtils
 import java.security.KeyPair
 import java.security.MessageDigest
 import android.util.Base64 as AndroidBase64
+import androidx.biometric.BiometricManager
 import androidx.biometric.BiometricPrompt
 import androidx.core.content.ContextCompat
 import androidx.lifecycle.lifecycleScope
@@ -251,13 +253,115 @@ class GetPasskeyActivity : AppCompatActivity() {
         layout.addView(cancelButton)
 
         setContentView(layout)
-        
+
         // Ensure the activity is focusable and can receive touches
         layout.isFocusable = true
         layout.isFocusableInTouchMode = true
         layout.requestFocus()
     }
 
+    private fun setupErrorUI(message: String, allowRetry: Boolean) {
+        if (isFinishing || isDestroyed) return
+
+        val layout = LinearLayout(this).apply {
+            val padding = (32 * resources.displayMetrics.density).toInt()
+            orientation = LinearLayout.VERTICAL
+            setPadding(padding, padding, padding, padding)
+            gravity = Gravity.CENTER_HORIZONTAL
+            setBackgroundColor(Color.WHITE)
+        }
+
+        try {
+            val appInfo = packageManager.getApplicationInfo(packageName, 0)
+            val appIcon = packageManager.getApplicationIcon(appInfo)
+            val appLabel = packageManager.getApplicationLabel(appInfo)
+
+            val density = resources.displayMetrics.density
+            val iconSize = (48 * density).toInt()
+            val iconMargin = (12 * density).toInt()
+            val headerPadding = (40 * density).toInt()
+
+            val header = LinearLayout(this).apply {
+                orientation = LinearLayout.HORIZONTAL
+                gravity = Gravity.CENTER_VERTICAL
+                setPadding(0, 0, 0, headerPadding)
+            }
+
+            val iconView = ImageView(this).apply {
+                setImageDrawable(appIcon)
+                layoutParams = LinearLayout.LayoutParams(iconSize, iconSize).apply {
+                    marginEnd = iconMargin
+                }
+            }
+            header.addView(iconView)
+
+            val providerLabel = TextView(this).apply {
+                text = appLabel
+                textSize = 16f
+                typeface = Typeface.DEFAULT_BOLD
+                setTextColor(Color.DKGRAY)
+            }
+            header.addView(providerLabel)
+            layout.addView(header)
+        } catch (e: Exception) {
+        }
+
+        val title = TextView(this).apply {
+            text = "Couldn't sign in"
+            textSize = 28f
+            typeface = Typeface.DEFAULT_BOLD
+            setPadding(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+            setTextColor(Color.BLACK)
+        }
+        layout.addView(title)
+
+        val description = TextView(this).apply {
+            text = message
+            textSize = 16f
+            setPadding(0, 0, 0, (40 * resources.displayMetrics.density).toInt())
+            gravity = Gravity.CENTER_HORIZONTAL
+            setTextColor(Color.GRAY)
+        }
+        layout.addView(description)
+
+        if (allowRetry) {
+            val retryButton = Button(this).apply {
+                text = "Try Again"
+                contentDescription = "get-passkey-retry"
+                setOnClickListener {
+                    handleAssertion()
+                }
+                layoutParams = LinearLayout.LayoutParams(
+                    LinearLayout.LayoutParams.MATCH_PARENT,
+                    LinearLayout.LayoutParams.WRAP_CONTENT
+                ).apply {
+                    setMargins(0, 0, 0, (8 * resources.displayMetrics.density).toInt())
+                }
+            }
+            layout.addView(retryButton)
+        }
+
+        val closeButton = Button(this, null, android.R.attr.borderlessButtonStyle).apply {
+            text = "Close"
+            contentDescription = "get-passkey-cancel"
+            setOnClickListener {
+                setResult(RESULT_CANCELED)
+                finish()
+            }
+            layoutParams = LinearLayout.LayoutParams(
+                LinearLayout.LayoutParams.MATCH_PARENT,
+                LinearLayout.LayoutParams.WRAP_CONTENT
+            )
+        }
+        layout.addView(closeButton)
+
+        setContentView(layout)
+
+        layout.isFocusable = true
+        layout.isFocusableInTouchMode = true
+        layout.requestFocus()
+    }
+
     @SuppressLint("RestrictedApi")
     private fun handleAssertion() {
         if (isHandling) return
@@ -271,10 +375,11 @@ class GetPasskeyActivity : AppCompatActivity() {
             val cipherToUse = systemUnlockedCipher ?: run {
                 if (biometricPromptResult != null) {
                     try {
+                        val requirement = BiometricRequirement.resolve(this@GetPasskeyActivity)
                         val fallback = if (biometricIv != null) {
-                            credentialRepository.getBiometricCipherForDecryption(AndroidBase64.decode(biometricIv, AndroidBase64.DEFAULT))
+                            credentialRepository.getBiometricCipherForDecryption(this@GetPasskeyActivity, AndroidBase64.decode(biometricIv, AndroidBase64.DEFAULT), requirement)
                         } else {
-                            credentialRepository.getBiometricCipherForEncryption()
+                            credentialRepository.getBiometricCipherForEncryption(this@GetPasskeyActivity, requirement)
                         }
                         Log.i(TAG, "Successfully obtained fallback cipher from repository (Single Tap timeout)")
                         fallback
@@ -294,7 +399,20 @@ class GetPasskeyActivity : AppCompatActivity() {
                     Log.d(TAG, "Manual biometrics result: $result")
                     if (result == null) {
                         Log.w(TAG, "Biometrics failed or was canceled")
-                        setupUI() // Show UI as fallback
+                        val requirement = BiometricRequirement.resolve(this@GetPasskeyActivity)
+                        val canUseBiometrics =
+                            BiometricManager.from(this@GetPasskeyActivity)
+                                .canAuthenticate(
+                                    requirement.allowedAuthenticators,
+                                ) == BiometricManager.BIOMETRIC_SUCCESS
+                        if (canUseBiometrics) {
+                            setupUI()
+                        } else {
+                            setupErrorUI(
+                                "This device has no screen lock or biometric set up, which passkeys require. Add one in your device settings, then try again.",
+                                allowRetry = false,
+                            )
+                        }
                         isHandling = false
                         return@launch
                     }
@@ -454,6 +572,44 @@ class GetPasskeyActivity : AppCompatActivity() {
             val credProps = JSONObject()
             credProps.put("rk", true)
             clientExtensionResults.put("credProps", credProps)
+
+            // WebAuthn `prf` extension (hmac-secret). If the RP requested PRF
+            // evaluation for this assertion, derive the per-credential
+            // `credRandom` from the wallet HD root secret and compute
+            // HMAC-SHA256-based outputs for the supplied salt(s).
+            try {
+                val credentialIdB64Url = AndroidBase64.encodeToString(
+                    credId,
+                    AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING,
+                )
+                val prfInput = Prf.parseInput(passkeyRequestJsonObj, credentialIdB64Url)
+                if (prfInput != null) {
+                    val hdRootSecret = credentialRepository.getHdRootSecret(this@GetPasskeyActivity)
+                    if (hdRootSecret == null) {
+                        Log.w(TAG, "PRF input present but HD root secret unavailable; skipping PRF output")
+                    } else {
+                        val credRandom = Prf.credRandom(
+                            hdRootSecret = hdRootSecret,
+                            relyingPartyIdentifier = displayOrigin,
+                            userHandle = dbCred.userHandle,
+                        )
+                        val first = Prf.evaluate(credRandom, prfInput.first, prfInput.alreadyHashed)
+                        val second = prfInput.second?.let { Prf.evaluate(credRandom, it, prfInput.alreadyHashed) }
+
+                        val prfResults = JSONObject().put("first", Prf.encodeOutput(first))
+                        if (second != null) {
+                            prfResults.put("second", Prf.encodeOutput(second))
+                        }
+                        clientExtensionResults.put("prf", JSONObject().put("results", prfResults))
+                        Log.d(TAG, "Computed PRF assertion output (second present=${second != null})")
+                    }
+                }
+            } catch (e: Exception) {
+                // Never fail the assertion because of a PRF error; just log
+                // and omit the extension result.
+                Log.w(TAG, "Failed to compute PRF assertion output", e)
+            }
+
             fullJson.put("clientExtensionResults", clientExtensionResults)
 
             val credentialJson = fullJson.toString()
@@ -469,19 +625,25 @@ class GetPasskeyActivity : AppCompatActivity() {
 
             setResult(Activity.RESULT_OK, resultIntent)
             Log.d(TAG, "Result set to OK")
+            credentialRepository.recordCredentialUsage(this@GetPasskeyActivity, credId)
             ReactNativePasskeyAutofillModule.instance?.sendEvent("onPasskeyAuthenticated", Bundle().apply {
                 putBoolean("success", true)
+                putString("credentialId", credentialIdEnc)
             })
             finish()
         } catch (e: Exception) {
             Log.e(TAG, "Error during passkey assertion", e)
-            setupUI() // Show UI on error
+            setupErrorUI(
+                "Something went wrong while signing in. Please try again.",
+                allowRetry = true,
+            )
             isHandling = false
         }
     }
     }
 
     private suspend fun biometrics(iv: String?): BiometricPrompt.AuthenticationResult? {
+        val requirement = BiometricRequirement.resolve(this)
         return suspendCoroutine { continuation ->
             val biometricPrompt = BiometricPrompt(
                 this,
@@ -502,17 +664,19 @@ class GetPasskeyActivity : AppCompatActivity() {
                     }
                 }
             )
-            val promptInfo = BiometricPrompt.PromptInfo.Builder()
+            val promptInfoBuilder = BiometricPrompt.PromptInfo.Builder()
                 .setTitle("Sign In")
                 .setSubtitle("Authenticate to use your passkey")
-                .setNegativeButtonText("Cancel")
-                .setAllowedAuthenticators(androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG)
-                .build()
-            
-            if (iv != null) {
+                .setAllowedAuthenticators(requirement.allowedAuthenticators)
+            if (!requirement.allowsDeviceCredential) {
+                promptInfoBuilder.setNegativeButtonText("Cancel")
+            }
+            val promptInfo = promptInfoBuilder.build()
+
+            if (iv != null && requirement.isCryptoBound) {
                 try {
                     val ivBytes = AndroidBase64.decode(iv, AndroidBase64.DEFAULT)
-                    val cipher = credentialRepository.getBiometricCipherForDecryption(ivBytes)
+                    val cipher = credentialRepository.getBiometricCipherForDecryption(this, ivBytes, requirement)
                     biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
                 } catch (e: Exception) {
                     Log.e(TAG, "Failed to initialize biometric prompt with cipher", e)

package/android/src/main/java/co/algorand/passkeyautofill/Prf.kt

@@ -0,0 +1,184 @@
+package co.algorand.passkeyautofill
+
+import android.util.Base64 as AndroidBase64
+import java.security.MessageDigest
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+import org.json.JSONObject
+
+/**
+ * WebAuthn PRF (`prf`) extension helpers, backed by the authenticator
+ * `hmac-secret` mechanism (CTAP2.1).
+ *
+ * Output formula per the WebAuthn spec:
+ *
+ *     output = HMAC-SHA256(credRandom, SHA256("WebAuthn PRF" || 0x00 || salt))
+ *
+ * `credRandom` is a per-credential 32-byte secret. We derive it
+ * deterministically (HKDF-SHA256) from the wallet HD root secret, the
+ * relying-party identifier, and the user handle — the same inputs that
+ * produce the deterministic signing key. This avoids a storage migration
+ * and ensures restoring the wallet seed reproduces the same PRF outputs
+ * on another device.
+ */
+object Prf {
+  private const val CRED_RANDOM_INFO = "WebAuthn-PRF-credRandom"
+  private val SALT_PREFIX: ByteArray = "WebAuthn PRF".toByteArray(Charsets.UTF_8) + byteArrayOf(0x00)
+
+  /**
+   * Derive a 32-byte per-credential PRF secret from the HD root secret.
+   * Deterministic over `(hdRootSecret, rpId, userHandle)`.
+   */
+  fun credRandom(
+    hdRootSecret: ByteArray,
+    relyingPartyIdentifier: String,
+    userHandle: String,
+  ): ByteArray {
+    val salt = relyingPartyIdentifier.lowercase().toByteArray(Charsets.UTF_8) +
+      byteArrayOf(0x00) +
+      userHandle.lowercase().toByteArray(Charsets.UTF_8)
+    return hkdfSha256(
+      ikm = hdRootSecret,
+      salt = salt,
+      info = CRED_RANDOM_INFO.toByteArray(Charsets.UTF_8),
+      length = 32,
+    )
+  }
+
+  /**
+   * Evaluate the PRF for a single salt. Returns 32 bytes of output material.
+   *
+   * Per the WebAuthn spec the value the authenticator HMACs is
+   * `SHA-256("WebAuthn PRF" || 0x00 || rpSalt)`. The Chromium-on-Android
+   * client manager performs this hashing on behalf of the RP and passes the
+   * result through the `prfAlreadyHashed` extension; in that case the
+   * `salt` is already the inner hash and we must NOT hash again. Standard
+   * `prf` requests send the raw RP salt and require hashing.
+   */
+  fun evaluate(credRandom: ByteArray, salt: ByteArray, alreadyHashed: Boolean = true): ByteArray {
+    val macInput = if (alreadyHashed) {
+      salt
+    } else {
+      MessageDigest.getInstance("SHA-256").digest(SALT_PREFIX + salt)
+    }
+    val mac = Mac.getInstance("HmacSHA256").apply {
+      init(SecretKeySpec(credRandom, "HmacSHA256"))
+    }
+    return mac.doFinal(macInput)
+  }
+
+  /**
+   * Parsed PRF inputs from the relying party. Reduced to at most two salts
+   * (first + optional second) — already resolved against `evalByCredential`
+   * for the credential the user is asserting with.
+   *
+   * @property alreadyHashed `true` when the salts have already been passed
+   *   through `SHA-256("WebAuthn PRF" || 0x00 || ...)` by the platform (the
+   *   case for both the Chromium `prfAlreadyHashed` extension on Android
+   *   and Apple's `ASAuthorizationPublicKeyCredentialPRFAssertionInput`).
+   */
+  data class Input(val first: ByteArray, val second: ByteArray?, val alreadyHashed: Boolean)
+
+  /**
+   * Parse PRF eval salts out of a WebAuthn request JSON.
+   *
+   * Recognises:
+   *  - `extensions.prf.eval` / `extensions.prf.evalByCredential[<credId>]`
+   *    — raw RP-supplied salts that still need to be hashed before HMAC.
+   *  - `extensions.prfAlreadyHashed.eval` /
+   *    `extensions.prfAlreadyHashed.evalByCredential[<credId>]` — Chromium
+   *    on Android emits this when forwarding a `prf` request to a credential
+   *    provider so the provider doesn't need to know the spec-mandated hash
+   *    prefix. The salts here are already 32-byte SHA-256 outputs and must
+   *    not be re-hashed.
+   *
+   * @param requestJson the inner `publicKey` request JSON object.
+   * @param credentialIdB64Url base64url-encoded credentialId we're asserting
+   *   with (used to look up the per-credential salts).
+   */
+  fun parseInput(requestJson: JSONObject, credentialIdB64Url: String?): Input? {
+    val extensions = requestJson.optJSONObject("extensions") ?: return null
+
+    // Pre-hashed form wins — when Chromium sends both for compatibility,
+    // honour the already-hashed values to match what the browser expects.
+    extensions.optJSONObject("prfAlreadyHashed")?.let { node ->
+      parseExtensionNode(node, credentialIdB64Url, alreadyHashed = true)?.let { return it }
+    }
+    extensions.optJSONObject("prf")?.let { node ->
+      parseExtensionNode(node, credentialIdB64Url, alreadyHashed = false)?.let { return it }
+    }
+    return null
+  }
+
+  private fun parseExtensionNode(
+    node: JSONObject,
+    credentialIdB64Url: String?,
+    alreadyHashed: Boolean,
+  ): Input? {
+    // Per-credential salts win over the global `eval` block.
+    if (credentialIdB64Url != null) {
+      val byCred = node.optJSONObject("evalByCredential")
+      if (byCred != null) {
+        for (key in byCred.keys()) {
+          if (normalizeBase64Url(key) == normalizeBase64Url(credentialIdB64Url)) {
+            byCred.optJSONObject(key)?.let { return parseSalts(it, alreadyHashed) }
+          }
+        }
+      }
+    }
+    return node.optJSONObject("eval")?.let { parseSalts(it, alreadyHashed) }
+  }
+
+  private fun parseSalts(obj: JSONObject, alreadyHashed: Boolean): Input? {
+    val first = obj.optString("first", "").takeIf { it.isNotEmpty() } ?: return null
+    val firstBytes = decodeBase64UrlOrBase64(first)
+    val secondBytes = obj.optString("second", "")
+      .takeIf { it.isNotEmpty() }
+      ?.let { decodeBase64UrlOrBase64(it) }
+    return Input(firstBytes, secondBytes, alreadyHashed)
+  }
+
+  private fun normalizeBase64Url(value: String): String =
+    value.trim().trimEnd('=').replace('+', '-').replace('/', '_')
+
+  private fun decodeBase64UrlOrBase64(value: String): ByteArray {
+    val flags = AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING
+    return try {
+      AndroidBase64.decode(value, flags)
+    } catch (e: IllegalArgumentException) {
+      AndroidBase64.decode(value, AndroidBase64.NO_WRAP)
+    }
+  }
+
+  /** Encode a 32-byte PRF output for inclusion in a WebAuthn response JSON. */
+  fun encodeOutput(bytes: ByteArray): String =
+    AndroidBase64.encodeToString(bytes, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
+
+  // RFC 5869 HKDF-SHA256.
+  private fun hkdfSha256(ikm: ByteArray, salt: ByteArray, info: ByteArray, length: Int): ByteArray {
+    val mac = Mac.getInstance("HmacSHA256")
+    val effectiveSalt = if (salt.isEmpty()) ByteArray(32) else salt
+    // Extract.
+    mac.init(SecretKeySpec(effectiveSalt, "HmacSHA256"))
+    val prk = mac.doFinal(ikm)
+    // Expand.
+    mac.init(SecretKeySpec(prk, "HmacSHA256"))
+    val output = ByteArray(length)
+    var t = ByteArray(0)
+    var offset = 0
+    var counter: Byte = 1
+    while (offset < length) {
+      mac.reset()
+      mac.init(SecretKeySpec(prk, "HmacSHA256"))
+      mac.update(t)
+      mac.update(info)
+      mac.update(counter)
+      t = mac.doFinal()
+      val take = minOf(t.size, length - offset)
+      System.arraycopy(t, 0, output, offset, take)
+      offset += take
+      counter++
+    }
+    return output
+  }
+}