@sparkvault/sdk-mobile 4.1.1 → 4.3.0

package/README.md

@@ -94,10 +94,10 @@ const passkeyProvider: MobilePasskeyProvider = {
   isSupported: () => Passkey.isSupported(),
   authenticate: async (options) => {
     const credential = await Passkey.get({
-	      challenge: options.challenge,
-	      timeout: options.timeout,
-	      rpId: options.rpId,
-	      userVerification: options.userVerification,
+      challenge: options.challenge,
+      timeout: options.timeout,
+      rpId: options.rpId,
+      userVerification: options.userVerification,
     });
 
     return credential
@@ -109,6 +109,8 @@ const passkeyProvider: MobilePasskeyProvider = {
             clientDataJSON: credential.response.clientDataJSON,
             authenticatorData: credential.response.authenticatorData,
             signature: credential.response.signature,
+            // Required: the server resolves the SVID from the userHandle.
+            userHandle: credential.response.userHandle,
           },
         }
       : null;

package/dist/types.d.ts

@@ -351,6 +351,11 @@ export interface PasskeyRegisterChallenge {
     options: PasskeyRegisterOptions;
     session: PasskeySession;
 }
+/**
+ * JSON-encoded WebAuthn credential returned by a native passkey provider,
+ * shared by authentication assertions (`authenticatorData`/`signature`) and
+ * registration attestations (`attestationObject`).
+ */
 export interface PasskeyCredential {
     id: string;
     rawId: string;
@@ -359,6 +364,15 @@ export interface PasskeyCredential {
         authenticatorData?: string;
         signature?: string;
         attestationObject?: string;
+        /**
+         * Base64url user handle from an authentication assertion. Optional only
+         * because this shape also carries registration attestations, which have
+         * no user handle (matching the native lib's `userHandle?: string`).
+         * Verification requires it: the Identity server resolves the SVID solely
+         * from this value (`allowCredentials` is just an authenticator hint), so
+         * providers must pass it through verbatim on authenticate.
+         */
+        userHandle?: string;
     };
     type: 'public-key';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkvault/sdk-mobile",
-  "version": "4.1.1",
+  "version": "4.3.0",
   "description": "Mobile SDK for SparkVault Identity, vault, folder, and ingot workflows",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
   ],
   "author": "SparkVault",
   "license": "PROPRIETARY",
-  "homepage": "https://app.sparkvault.com/api/docs/sdk-mobile",
+  "homepage": "https://sparkvault.com/api/docs/sdk-mobile/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Spark-Vault/platform.git",

package/src/types.ts

@@ -419,6 +419,11 @@ export interface PasskeyRegisterChallenge {
   session: PasskeySession;
 }
 
+/**
+ * JSON-encoded WebAuthn credential returned by a native passkey provider,
+ * shared by authentication assertions (`authenticatorData`/`signature`) and
+ * registration attestations (`attestationObject`).
+ */
 export interface PasskeyCredential {
   id: string;
   rawId: string;
@@ -427,6 +432,15 @@ export interface PasskeyCredential {
     authenticatorData?: string;
     signature?: string;
     attestationObject?: string;
+    /**
+     * Base64url user handle from an authentication assertion. Optional only
+     * because this shape also carries registration attestations, which have
+     * no user handle (matching the native lib's `userHandle?: string`).
+     * Verification requires it: the Identity server resolves the SVID solely
+     * from this value (`allowCredentials` is just an authenticator hint), so
+     * providers must pass it through verbatim on authenticate.
+     */
+    userHandle?: string;
   };
   type: 'public-key';
 }