prfOutputSecond

32-byte PRF output for the second salt when the caller passed one to authenticateWithPrf. Null when the caller didn't request a second salt OR when the authenticator only evaluated the first.

WebAuthn's PRF extension supports eval.first and eval.second in a single assertion — modern authenticators (Google Password Manager since Chrome 132, hardware tokens) collapse "derive two domain-separated secrets" to one biometric prompt. Callers that need two outputs should always pass both salts and check this field; null means fall back to a second ceremony.