@capgo/capacitor-passkey 8.4.0 → 8.5.2

package/dist/esm/definitions.d.ts

@@ -424,6 +424,61 @@ export interface PasskeyAuthenticationCredential {
      */
     response: PasskeyAuthenticatorAssertionResponseJSON;
 }
+/**
+ * Shape of the `data` object on a rejected passkey call.
+ *
+ * Capacitor surfaces this as `error.data` on the rejected promise.
+ * `code` / `name` on the error stay WebAuthn-style (`NotAllowedError`, etc.);
+ * platform diagnostics live under `native` when available.
+ *
+ * @since 8.5.0
+ */
+export interface PasskeyErrorData {
+    /**
+     * WebAuthn-style error name. Same value as the Capacitor error code.
+     */
+    name: string;
+    /**
+     * Platform error details, for diagnostics.
+     *
+     * Omitted when the plugin itself raised the failure (for example invalid
+     * request JSON) rather than the native credential API.
+     */
+    native?: PasskeyNativeErrorDetails;
+}
+/**
+ * Platform-native error details attached to a rejected passkey call.
+ *
+ * Nested and platform-neutral so Android can report the same shape later.
+ *
+ * @since 8.5.0
+ */
+export interface PasskeyNativeErrorDetails {
+    /**
+     * Platform that produced the native error.
+     */
+    platform: 'ios' | 'android';
+    /**
+     * Platform error code.
+     *
+     * On iOS this is the `ASAuthorizationError` code (for example `1004` when
+     * the webcredentials association cannot be verified).
+     */
+    code: number | string;
+    /**
+     * Platform error domain.
+     *
+     * On iOS this is the `NSError` domain (for example
+     * `com.apple.AuthenticationServices.AuthorizationError`).
+     */
+    domain?: string;
+    /**
+     * Platform-provided failure reason, when available.
+     *
+     * On iOS this comes from `NSLocalizedFailureReasonErrorKey`.
+     */
+    failureReason?: string;
+}
 /**
  * Plugin version payload.
  *

package/dist/esm/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Supported authenticator attachment values.\n *\n * @since 1.0.0\n */\nexport type PasskeyAuthenticatorAttachment = 'platform' | 'cross-platform';\n\n/**\n * Supported WebAuthn credential type.\n *\n * @since 1.0.0\n */\nexport type PasskeyCredentialType = 'public-key';\n\n/**\n * Supported user verification preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyUserVerification = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Supported attestation preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyAttestation = 'none' | 'indirect' | 'direct' | 'enterprise';\n\n/**\n * Supported resident key preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyResidentKey = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Options used when installing the browser-style shim.\n *\n * @since 1.0.0\n */\nexport interface ShimWebAuthnOptions {\n  /**\n   * Optional HTTPS origin to encode into iOS 17.4+ clientDataJSON.\n   *\n   * Use this when your Capacitor app runs from `capacitor://localhost`\n   * but your relying party expects `https://signin.example.com`.\n   */\n  origin?: string;\n\n  /**\n   * Force the shim even if the runtime already exposes `navigator.credentials`.\n   *\n   * Defaults to `false`.\n   */\n  force?: boolean;\n}\n\n/**\n * Runtime configuration loaded from the host app's Capacitor config.\n *\n * This is the shape returned by `getConfiguration()`.\n *\n * @since 1.1.0\n */\nexport interface PasskeyRuntimeConfiguration {\n  /**\n   * Whether the native `cap sync/update` hook should wire host projects automatically.\n   *\n   * Defaults to `true`.\n   */\n  autoShim: boolean;\n\n  /**\n   * Optional HTTPS origin used by the config-driven shim install.\n   *\n   * On iOS 17.4+ this origin is encoded into `clientDataJSON`.\n   */\n  origin?: string;\n\n  /**\n   * Domains associated with the app for passkey usage.\n   *\n   * These come from `domains` in Capacitor config plus the hostname derived\n   * from `origin` when available.\n   */\n  domains: string[];\n\n  /**\n   * Current runtime platform.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * JSON-safe representation of a public key credential descriptor.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialDescriptor {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type?: PasskeyCredentialType;\n\n  /**\n   * Optional transport hints copied from WebAuthn.\n   */\n  transports?: string[];\n}\n\n/**\n * JSON-safe relying party information.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRelyingParty {\n  /**\n   * Relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  id?: string;\n\n  /**\n   * Human-readable relying party name.\n   */\n  name: string;\n}\n\n/**\n * JSON-safe WebAuthn user entity.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyUserEntity {\n  /**\n   * Base64url-encoded user handle.\n   */\n  id: string;\n\n  /**\n   * User name shown by the authenticator.\n   */\n  name: string;\n\n  /**\n   * Optional display name shown by the authenticator.\n   */\n  displayName?: string;\n}\n\n/**\n * JSON-safe credential parameter entry.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialParameter {\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * COSE algorithm identifier.\n   */\n  alg: number;\n}\n\n/**\n * JSON-safe authenticator selection options.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorSelection {\n  /**\n   * Optional authenticator attachment hint.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Optional resident key preference.\n   */\n  residentKey?: PasskeyResidentKey;\n\n  /**\n   * Legacy resident key requirement flag.\n   */\n  requireResidentKey?: boolean;\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n}\n\n/**\n * JSON-safe registration request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialCreationOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Relying party information.\n   */\n  rp: PasskeyRelyingParty;\n\n  /**\n   * User information.\n   */\n  user: PasskeyUserEntity;\n\n  /**\n   * Supported credential algorithms.\n   */\n  pubKeyCredParams: PasskeyCredentialParameter[];\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional credentials that must be excluded during registration.\n   */\n  excludeCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional authenticator preferences.\n   */\n  authenticatorSelection?: PasskeyAuthenticatorSelection;\n\n  /**\n   * Optional attestation preference.\n   */\n  attestation?: PasskeyAttestation;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct registration request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface CreateCredentialOptions {\n  /**\n   * JSON-safe registration request.\n   */\n  publicKey: PasskeyPublicKeyCredentialCreationOptionsJSON;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n}\n\n/**\n * JSON-safe authentication request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialRequestOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  rpId?: string;\n\n  /**\n   * Optional allow list copied from WebAuthn.\n   */\n  allowCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct authentication request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface GetCredentialOptions {\n  /**\n   * JSON-safe authentication request.\n   */\n  publicKey: PasskeyPublicKeyCredentialRequestOptionsJSON;\n\n  /**\n   * Optional mediation hint. `conditional` currently falls back to an explicit prompt.\n   */\n  mediation?: string;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n\n  /**\n   * Prefer passkeys stored on the local device, skipping the hybrid/nearby-device picker.\n   * Fails with `NotAllowedError` when no local credential exists. Ignored on web and iOS 15.\n   */\n  preferImmediatelyAvailableCredentials?: boolean;\n}\n\n/**\n * JSON-safe attestation response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAttestationResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded attestation object.\n   */\n  attestationObject: string;\n\n  /**\n   * Optional base64url-encoded public key when provided by the platform.\n   */\n  publicKey?: string;\n\n  /**\n   * Optional public key algorithm when provided by the platform.\n   */\n  publicKeyAlgorithm?: number;\n\n  /**\n   * Optional transport list when provided by the platform.\n   */\n  transports?: string[];\n\n  /**\n   * Optional base64url-encoded authenticator data.\n   */\n  authenticatorData?: string;\n}\n\n/**\n * JSON-safe assertion response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAssertionResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded authenticator data.\n   */\n  authenticatorData: string;\n\n  /**\n   * Base64url-encoded signature.\n   */\n  signature: string;\n\n  /**\n   * Optional base64url-encoded user handle.\n   */\n  userHandle?: string | null;\n}\n\n/**\n * JSON-safe registration credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRegistrationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Registration response payload.\n   */\n  response: PasskeyAuthenticatorAttestationResponseJSON;\n}\n\n/**\n * JSON-safe authentication credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Assertion response payload.\n   */\n  response: PasskeyAuthenticatorAssertionResponseJSON;\n}\n\n/**\n * Plugin version payload.\n *\n * @since 1.0.0\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier reported by the current platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Passkey support status for the current runtime.\n *\n * @since 1.0.0\n */\nexport interface PasskeySupportResult {\n  /**\n   * Whether passkeys are available on the current runtime.\n   */\n  available: boolean;\n\n  /**\n   * Whether conditional mediation is available.\n   */\n  conditionalMediation: boolean;\n\n  /**\n   * Current platform identifier.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * Capacitor Passkey plugin.\n *\n * Use `autoShimWebAuthn()` to keep existing `navigator.credentials.create/get`\n * code working inside a Capacitor app.\n *\n * @since 1.0.0\n */\nexport interface CapacitorPasskeyPlugin {\n  /**\n   * Install a browser-style WebAuthn shim on top of the native plugin.\n   *\n   * The shim patches `navigator.credentials.create/get` for `publicKey`\n   * requests and returns browser-like credential objects.\n   *\n   * Use this when you want to override the auto-loaded config manually.\n   *\n   * @since 1.0.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * CapacitorPasskey.shimWebAuthn({\n   *   origin: 'https://signin.example.com',\n   * });\n   * ```\n   */\n  shimWebAuthn(options?: ShimWebAuthnOptions): void;\n\n  /**\n   * Load plugin configuration from the host Capacitor app.\n   *\n   * This reads `plugins.CapacitorPasskey` from `capacitor.config.*`.\n   *\n   * @since 1.1.0\n   */\n  getConfiguration(): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Install the browser-style shim using host app configuration.\n   *\n   * This is the easiest way to keep existing browser WebAuthn code working:\n   * configure the plugin in `capacitor.config.*`, then call this once during\n   * app bootstrap.\n   *\n   * @since 1.1.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * await CapacitorPasskey.autoShimWebAuthn();\n   * ```\n   */\n  autoShimWebAuthn(options?: ShimWebAuthnOptions): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Register a passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialCreationOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  createCredential(options: CreateCredentialOptions): Promise<PasskeyRegistrationCredential>;\n\n  /**\n   * Authenticate with an existing passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialRequestOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  getCredential(options: GetCredentialOptions): Promise<PasskeyAuthenticationCredential>;\n\n  /**\n   * Report whether passkeys are available in the current runtime.\n   *\n   * @since 1.0.0\n   */\n  isSupported(): Promise<PasskeySupportResult>;\n\n  /**\n   * Returns the current platform implementation version marker.\n   *\n   * @since 1.0.0\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Supported authenticator attachment values.\n *\n * @since 1.0.0\n */\nexport type PasskeyAuthenticatorAttachment = 'platform' | 'cross-platform';\n\n/**\n * Supported WebAuthn credential type.\n *\n * @since 1.0.0\n */\nexport type PasskeyCredentialType = 'public-key';\n\n/**\n * Supported user verification preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyUserVerification = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Supported attestation preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyAttestation = 'none' | 'indirect' | 'direct' | 'enterprise';\n\n/**\n * Supported resident key preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyResidentKey = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Options used when installing the browser-style shim.\n *\n * @since 1.0.0\n */\nexport interface ShimWebAuthnOptions {\n  /**\n   * Optional HTTPS origin to encode into iOS 17.4+ clientDataJSON.\n   *\n   * Use this when your Capacitor app runs from `capacitor://localhost`\n   * but your relying party expects `https://signin.example.com`.\n   */\n  origin?: string;\n\n  /**\n   * Force the shim even if the runtime already exposes `navigator.credentials`.\n   *\n   * Defaults to `false`.\n   */\n  force?: boolean;\n}\n\n/**\n * Runtime configuration loaded from the host app's Capacitor config.\n *\n * This is the shape returned by `getConfiguration()`.\n *\n * @since 1.1.0\n */\nexport interface PasskeyRuntimeConfiguration {\n  /**\n   * Whether the native `cap sync/update` hook should wire host projects automatically.\n   *\n   * Defaults to `true`.\n   */\n  autoShim: boolean;\n\n  /**\n   * Optional HTTPS origin used by the config-driven shim install.\n   *\n   * On iOS 17.4+ this origin is encoded into `clientDataJSON`.\n   */\n  origin?: string;\n\n  /**\n   * Domains associated with the app for passkey usage.\n   *\n   * These come from `domains` in Capacitor config plus the hostname derived\n   * from `origin` when available.\n   */\n  domains: string[];\n\n  /**\n   * Current runtime platform.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * JSON-safe representation of a public key credential descriptor.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialDescriptor {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type?: PasskeyCredentialType;\n\n  /**\n   * Optional transport hints copied from WebAuthn.\n   */\n  transports?: string[];\n}\n\n/**\n * JSON-safe relying party information.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRelyingParty {\n  /**\n   * Relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  id?: string;\n\n  /**\n   * Human-readable relying party name.\n   */\n  name: string;\n}\n\n/**\n * JSON-safe WebAuthn user entity.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyUserEntity {\n  /**\n   * Base64url-encoded user handle.\n   */\n  id: string;\n\n  /**\n   * User name shown by the authenticator.\n   */\n  name: string;\n\n  /**\n   * Optional display name shown by the authenticator.\n   */\n  displayName?: string;\n}\n\n/**\n * JSON-safe credential parameter entry.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialParameter {\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * COSE algorithm identifier.\n   */\n  alg: number;\n}\n\n/**\n * JSON-safe authenticator selection options.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorSelection {\n  /**\n   * Optional authenticator attachment hint.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Optional resident key preference.\n   */\n  residentKey?: PasskeyResidentKey;\n\n  /**\n   * Legacy resident key requirement flag.\n   */\n  requireResidentKey?: boolean;\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n}\n\n/**\n * JSON-safe registration request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialCreationOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Relying party information.\n   */\n  rp: PasskeyRelyingParty;\n\n  /**\n   * User information.\n   */\n  user: PasskeyUserEntity;\n\n  /**\n   * Supported credential algorithms.\n   */\n  pubKeyCredParams: PasskeyCredentialParameter[];\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional credentials that must be excluded during registration.\n   */\n  excludeCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional authenticator preferences.\n   */\n  authenticatorSelection?: PasskeyAuthenticatorSelection;\n\n  /**\n   * Optional attestation preference.\n   */\n  attestation?: PasskeyAttestation;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct registration request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface CreateCredentialOptions {\n  /**\n   * JSON-safe registration request.\n   */\n  publicKey: PasskeyPublicKeyCredentialCreationOptionsJSON;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n}\n\n/**\n * JSON-safe authentication request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialRequestOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  rpId?: string;\n\n  /**\n   * Optional allow list copied from WebAuthn.\n   */\n  allowCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct authentication request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface GetCredentialOptions {\n  /**\n   * JSON-safe authentication request.\n   */\n  publicKey: PasskeyPublicKeyCredentialRequestOptionsJSON;\n\n  /**\n   * Optional mediation hint. `conditional` currently falls back to an explicit prompt.\n   */\n  mediation?: string;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n\n  /**\n   * Prefer passkeys stored on the local device, skipping the hybrid/nearby-device picker.\n   * Fails with `NotAllowedError` when no local credential exists. Ignored on web and iOS 15.\n   */\n  preferImmediatelyAvailableCredentials?: boolean;\n}\n\n/**\n * JSON-safe attestation response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAttestationResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded attestation object.\n   */\n  attestationObject: string;\n\n  /**\n   * Optional base64url-encoded public key when provided by the platform.\n   */\n  publicKey?: string;\n\n  /**\n   * Optional public key algorithm when provided by the platform.\n   */\n  publicKeyAlgorithm?: number;\n\n  /**\n   * Optional transport list when provided by the platform.\n   */\n  transports?: string[];\n\n  /**\n   * Optional base64url-encoded authenticator data.\n   */\n  authenticatorData?: string;\n}\n\n/**\n * JSON-safe assertion response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAssertionResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded authenticator data.\n   */\n  authenticatorData: string;\n\n  /**\n   * Base64url-encoded signature.\n   */\n  signature: string;\n\n  /**\n   * Optional base64url-encoded user handle.\n   */\n  userHandle?: string | null;\n}\n\n/**\n * JSON-safe registration credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRegistrationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Registration response payload.\n   */\n  response: PasskeyAuthenticatorAttestationResponseJSON;\n}\n\n/**\n * JSON-safe authentication credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Assertion response payload.\n   */\n  response: PasskeyAuthenticatorAssertionResponseJSON;\n}\n\n/**\n * Shape of the `data` object on a rejected passkey call.\n *\n * Capacitor surfaces this as `error.data` on the rejected promise.\n * `code` / `name` on the error stay WebAuthn-style (`NotAllowedError`, etc.);\n * platform diagnostics live under `native` when available.\n *\n * @since 8.5.0\n */\nexport interface PasskeyErrorData {\n  /**\n   * WebAuthn-style error name. Same value as the Capacitor error code.\n   */\n  name: string;\n\n  /**\n   * Platform error details, for diagnostics.\n   *\n   * Omitted when the plugin itself raised the failure (for example invalid\n   * request JSON) rather than the native credential API.\n   */\n  native?: PasskeyNativeErrorDetails;\n}\n\n/**\n * Platform-native error details attached to a rejected passkey call.\n *\n * Nested and platform-neutral so Android can report the same shape later.\n *\n * @since 8.5.0\n */\nexport interface PasskeyNativeErrorDetails {\n  /**\n   * Platform that produced the native error.\n   */\n  platform: 'ios' | 'android';\n\n  /**\n   * Platform error code.\n   *\n   * On iOS this is the `ASAuthorizationError` code (for example `1004` when\n   * the webcredentials association cannot be verified).\n   */\n  code: number | string;\n\n  /**\n   * Platform error domain.\n   *\n   * On iOS this is the `NSError` domain (for example\n   * `com.apple.AuthenticationServices.AuthorizationError`).\n   */\n  domain?: string;\n\n  /**\n   * Platform-provided failure reason, when available.\n   *\n   * On iOS this comes from `NSLocalizedFailureReasonErrorKey`.\n   */\n  failureReason?: string;\n}\n\n/**\n * Plugin version payload.\n *\n * @since 1.0.0\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier reported by the current platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Passkey support status for the current runtime.\n *\n * @since 1.0.0\n */\nexport interface PasskeySupportResult {\n  /**\n   * Whether passkeys are available on the current runtime.\n   */\n  available: boolean;\n\n  /**\n   * Whether conditional mediation is available.\n   */\n  conditionalMediation: boolean;\n\n  /**\n   * Current platform identifier.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * Capacitor Passkey plugin.\n *\n * Use `autoShimWebAuthn()` to keep existing `navigator.credentials.create/get`\n * code working inside a Capacitor app.\n *\n * @since 1.0.0\n */\nexport interface CapacitorPasskeyPlugin {\n  /**\n   * Install a browser-style WebAuthn shim on top of the native plugin.\n   *\n   * The shim patches `navigator.credentials.create/get` for `publicKey`\n   * requests and returns browser-like credential objects.\n   *\n   * Use this when you want to override the auto-loaded config manually.\n   *\n   * @since 1.0.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * CapacitorPasskey.shimWebAuthn({\n   *   origin: 'https://signin.example.com',\n   * });\n   * ```\n   */\n  shimWebAuthn(options?: ShimWebAuthnOptions): void;\n\n  /**\n   * Load plugin configuration from the host Capacitor app.\n   *\n   * This reads `plugins.CapacitorPasskey` from `capacitor.config.*`.\n   *\n   * @since 1.1.0\n   */\n  getConfiguration(): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Install the browser-style shim using host app configuration.\n   *\n   * This is the easiest way to keep existing browser WebAuthn code working:\n   * configure the plugin in `capacitor.config.*`, then call this once during\n   * app bootstrap.\n   *\n   * @since 1.1.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * await CapacitorPasskey.autoShimWebAuthn();\n   * ```\n   */\n  autoShimWebAuthn(options?: ShimWebAuthnOptions): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Register a passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialCreationOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  createCredential(options: CreateCredentialOptions): Promise<PasskeyRegistrationCredential>;\n\n  /**\n   * Authenticate with an existing passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialRequestOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  getCredential(options: GetCredentialOptions): Promise<PasskeyAuthenticationCredential>;\n\n  /**\n   * Report whether passkeys are available in the current runtime.\n   *\n   * @since 1.0.0\n   */\n  isSupported(): Promise<PasskeySupportResult>;\n\n  /**\n   * Returns the current platform implementation version marker.\n   *\n   * @since 1.0.0\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}

package/ios/Sources/CapacitorPasskeyPlugin/CapacitorPasskey.swift

@@ -1,3 +1,5 @@
+import AuthenticationServices
+import Capacitor
 import Foundation
 
 @objc public class CapacitorPasskey: NSObject {
@@ -31,6 +33,36 @@ import Foundation
 
         return data
     }
+
+    static func errorName(for code: ASAuthorizationError.Code) -> String {
+        switch code {
+        case .canceled, .failed, .notHandled:
+            return "NotAllowedError"
+        case .matchedExcludedCredential:
+            return "InvalidStateError"
+        default:
+            return "UnknownError"
+        }
+    }
+
+    static func nativeErrorDetails(from error: Error) -> JSObject? {
+        guard let authorizationError = error as? ASAuthorizationError else {
+            return nil
+        }
+
+        let nsError = error as NSError
+        var details: JSObject = [
+            "platform": "ios",
+            "code": authorizationError.code.rawValue,
+            "domain": nsError.domain
+        ]
+
+        if let reason = nsError.userInfo[NSLocalizedFailureReasonErrorKey] as? String {
+            details["failureReason"] = reason
+        }
+
+        return details
+    }
 }
 
 struct PasskeyPluginError: Error {

package/ios/Sources/CapacitorPasskeyPlugin/CapacitorPasskeyPlugin.swift

@@ -119,9 +119,9 @@ private func normalizeDomain(_ value: String?) -> String? {
 
 @objc(CapacitorPasskeyPlugin)
 public class CapacitorPasskeyPlugin: CAPPlugin,
-    CAPBridgedPlugin,
-    ASAuthorizationControllerDelegate,
-    ASAuthorizationControllerPresentationContextProviding {
+                                     CAPBridgedPlugin,
+                                     ASAuthorizationControllerDelegate,
+                                     ASAuthorizationControllerPresentationContextProviding {
     public let identifier = "CapacitorPasskeyPlugin"
     public let jsName = "CapacitorPasskey"
     public let pluginMethods: [CAPPluginMethod] = [
@@ -242,14 +242,17 @@ public class CapacitorPasskeyPlugin: CAPPlugin,
 
         clearPendingRequest()
         if let authorizationError = error as? ASAuthorizationError {
-            switch authorizationError.code {
-            case .canceled, .failed, .notHandled:
-                reject(call, name: "NotAllowedError", message: authorizationError.localizedDescription, error: error)
-            case .matchedExcludedCredential:
-                reject(call, name: "InvalidStateError", message: authorizationError.localizedDescription, error: error)
-            default:
-                reject(call, name: "UnknownError", message: authorizationError.localizedDescription, error: error)
+            var data: JSObject = [:]
+            if let native = CapacitorPasskey.nativeErrorDetails(from: error) {
+                data["native"] = native
             }
+            reject(
+                call,
+                name: CapacitorPasskey.errorName(for: authorizationError.code),
+                message: authorizationError.localizedDescription,
+                error: error,
+                data: data
+            )
             return
         }
 
@@ -395,8 +398,15 @@ public class CapacitorPasskeyPlugin: CAPPlugin,
         reject(call, name: error.name, message: error.message)
     }
 
-    private func reject(_ call: CAPPluginCall, name: String, message: String, error: Error? = nil) {
-        let data: JSObject = ["name": name]
-        call.reject(message, name, error, data)
+    private func reject(
+        _ call: CAPPluginCall,
+        name: String,
+        message: String,
+        error: Error? = nil,
+        data: JSObject = [:]
+    ) {
+        var payload = data
+        payload["name"] = name
+        call.reject(message, name, error, payload)
     }
 }

package/ios/Tests/CapacitorPasskeyPluginTests/CapacitorPasskeyPluginTests.swift

@@ -1,3 +1,4 @@
+import AuthenticationServices
 import XCTest
 @testable import CapacitorPasskeyPlugin
 
@@ -14,4 +15,56 @@ class CapacitorPasskeyPluginTests: XCTestCase {
 
         XCTAssertEqual(input, decoded)
     }
+
+    func testErrorNameMatrix() {
+        let cases: [(ASAuthorizationError.Code, String)] = [
+            (.canceled, "NotAllowedError"),
+            (.failed, "NotAllowedError"),
+            (.notHandled, "NotAllowedError"),
+        ]
+
+        for (code, expected) in cases {
+            XCTAssertEqual(
+                CapacitorPasskey.errorName(for: code),
+                expected,
+                "ASAuthorizationError.Code rawValue \(code.rawValue)"
+            )
+        }
+
+        if #available(iOS 18.0, *) {
+            XCTAssertEqual(
+                CapacitorPasskey.errorName(for: .matchedExcludedCredential),
+                "InvalidStateError"
+            )
+        }
+    }
+
+    func testNativeErrorDetailsMatrix() throws {
+        let associationFailure = NSError(
+            domain: ASAuthorizationError.errorDomain,
+            code: ASAuthorizationError.Code.failed.rawValue,
+            userInfo: [NSLocalizedFailureReasonErrorKey: "Unable to verify webcredentials association"]
+        )
+        let associationDetails = try XCTUnwrap(CapacitorPasskey.nativeErrorDetails(from: associationFailure))
+        XCTAssertEqual(associationDetails["code"] as? Int, 1004)
+        XCTAssertEqual(associationDetails["platform"] as? String, "ios")
+        XCTAssertEqual(associationDetails["domain"] as? String, ASAuthorizationError.errorDomain)
+        XCTAssertEqual(
+            associationDetails["failureReason"] as? String,
+            "Unable to verify webcredentials association"
+        )
+
+        let canceled = NSError(
+            domain: ASAuthorizationError.errorDomain,
+            code: ASAuthorizationError.Code.canceled.rawValue,
+            userInfo: [:]
+        )
+        let canceledDetails = try XCTUnwrap(CapacitorPasskey.nativeErrorDetails(from: canceled))
+        XCTAssertEqual(canceledDetails["code"] as? Int, 1001)
+        XCTAssertEqual(canceledDetails["platform"] as? String, "ios")
+        XCTAssertNil(canceledDetails["failureReason"])
+
+        let unrelated = NSError(domain: NSURLErrorDomain, code: NSURLErrorTimedOut, userInfo: nil)
+        XCTAssertNil(CapacitorPasskey.nativeErrorDetails(from: unrelated))
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-passkey",
-  "version": "8.4.0",
+  "version": "8.5.2",
   "description": "Capacitor passkey plugin with a WebAuthn-style shim for Capacitor apps.",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",
@@ -51,6 +51,7 @@
     "watch": "tsc --watch",
     "prepublishOnly": "bun run build",
     "check:wiring": "node scripts/check-capacitor-plugin-wiring.mjs",
+    "check:cap9-deprecated": "node scripts/check-cap9-deprecated.mjs",
     "example:install": "cd example-app && bun install --frozen-lockfile",
     "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build",
     "changelog:ai": "node scripts/generate-ai-changelog.mjs"