feat: support native passkeys without running a flow

[itaihanski]

Related Issues

Fixes https://github.com/descope/etc/issues/5336

Description

• Add descope.passkey with isSupported, signUp, signIn, signUpOrIn and add, matching the passkey API in the native Swift, Kotlin and Flutter SDKs
• Bump @descope/core-js-sdk to 2.67.1, which allows the empty origin that native clients send
• Document passkey setup in the README, including associated domains, Digital Asset Links, and the optional Android signing certificate registration

Must

• Tests
• Documentation (if applicable)

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

The review assignment covers different aspects of the code changes—documentation and dependency management—to ensure comprehensive review coverage for the PR.

Reviewer	Reason
gaokevin1	gaokevin1 should review the README.md updates, as they contributed to documentation which is crucial for understanding setup and usage of the new passkey feature.
asafshen	asafshen should review the yarn.lock changes to ensure dependency updates are correctly managed, impacting build consistency across environments.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Adds a native descope.passkey API (isSupported/signUp/signIn/signUpOrIn/add) that drives the WebAuthn ceremony through the vendored Swift/Kotlin SDKs while core-js-sdk handles the start/finish calls. Good bones — the JS orchestration mirrors the native SDKs exactly, create branching is right, and the tests cover the happy paths, the failed-start short circuit, and cancellation.

Sniffed out 2 issues:

• 1 🟡 MEDIUM: passkey rejections drop the detailed DescopeException.message
• 1 🟢 LOW: iOS reports passkeys supported on iOS 15

See inline comments for details. Woof!

---

Declared coverage: FULL — 14/14 changed files reviewed.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Shuni's Review

Re-reviewed the delta since 9ce7375 — one Kotlin line and an iOS refactor extracting a shared rejectPasskey helper. The error-detail fix is correct on both platforms, and folding the two-branch catch into one helper is cleaner than what I asked for. Good bones!

Sniffed out 1 issue:

• 1 🟢 LOW: iOS and Android forward different code values for the same passkey error

Note: the error-message thread is genuinely fixed, but GitHub denies this bot the resolve permission — needs a manual click. See inline for details. Woof!

---

Declared coverage: PARTIAL — 2/14 changed files reviewed.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Shuni's Review

Delta since e369ab4 is two one-line changes — both rejectPasskey helpers now pass message through as-is with a desc fallback instead of prefixing. Checked every passkey throw site on both platforms: the ?: desc fallback covers all the message-less ones (passkeyCancelled, passkeyNoPasskeys.with(cause:), passkeyFailed.with(cause:)), and code still carries the error identity. Clean — nothing new to report. Woof!

One earlier 🟢 still stands (not re-posting inline, the threads aren't coming back from the API): iOS and Android send different codes for the same condition — cancellation is S110002 vs K110002, passkeyFailed is S110001 vs K110001. Inherited from the vendored SDKs, same split flows already ship, but worth a README note since src/types.ts points callers at passkeyCancelled.

---

Declared coverage: PARTIAL — 2/14 changed files reviewed.