@corbado/observe 0.16.0 → 0.16.1

package/dist/index.d.mts

@@ -2203,13 +2203,46 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+/**
+ * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
+ * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
+ * @example
+ * ```ts
+ * import { sanitizeCreationOptions } from "@corbado/observe";
+ * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
+ * ```
+ */
 declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+/**
+ * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
+ * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ *
+ * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+/**
+ * Serializes WebAuthn authentication options. No fields are currently blacklisted;
+ * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input or call toJSON. No tracker initialization is required.
+ */
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+/**
+ * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
+ * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ *
+ * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeAssertionResponse(value: unknown): string | undefined;
 
 /**

package/dist/index.d.ts

@@ -2203,13 +2203,46 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+/**
+ * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
+ * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
+ * @example
+ * ```ts
+ * import { sanitizeCreationOptions } from "@corbado/observe";
+ * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
+ * ```
+ */
 declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+/**
+ * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
+ * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ *
+ * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+/**
+ * Serializes WebAuthn authentication options. No fields are currently blacklisted;
+ * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input or call toJSON. No tracker initialization is required.
+ */
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+/**
+ * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
+ * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ *
+ * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeAssertionResponse(value: unknown): string | undefined;
 
 /**