Package-level declarations

Storage for both the registered passkeys and the ephemeral per-ceremony challenge.

Infrastructure for Passkey support. Operates in one of 2 modes based on if the end system needs truly passwordless or has passkeys as an add-on option

The security-critical extension point. Implementations decode CBOR/COSE, validate attestation and check signatures using a library (eg. webauthn4j, Yubico).

Links a verified passkey (or any login) to the app's HTTP session: it writes the authenticated user handle onto a response and reads it back off later requests.