@muhkoo/connect 0.10.7-alpha.0 → 0.10.9-alpha.0

package/dist/server/index.js

@@ -2976,7 +2976,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.10.7-alpha.0";
+const VERSION = "0.10.9-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -3499,7 +3499,13 @@ async function createPasskeyWithPrf(opts) {
             user: { id: rand(16), name: opts.username, displayName: opts.username },
             challenge: rand(32),
             pubKeyCredParams: [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -257 }],
-            authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
+            // Force the PLATFORM authenticator (Touch ID / Windows Hello / iCloud
+            // Keychain). Our factor needs the PRF extension to wrap the seed, and
+            // third-party browser password-manager extensions register as cross-platform
+            // authenticators that often DON'T implement PRF — letting one handle the
+            // request is the main cause of "didn't return a PRF result" failures. Pinning
+            // to platform routes it to the OS authenticator, which supports PRF.
+            authenticatorSelection: { authenticatorAttachment: "platform", residentKey: "preferred", userVerification: "preferred" },
             extensions: { prf: {} },
         },
     }));