forge
Forge a NEW sigil — create a fresh passkey AND derive its identity (+ pre-warm the wallet seed) in a single biometric ceremony via PRF-on-create.
Why this exists. The old forge ran createPasskey then a SEPARATE PRF GET to derive the DID. That GET could fail on the just-created credential — Cannot find credential in local KeyStore or database — until a backup/sync pass (bmgr run) propagated it, and it was a second biometric prompt besides. Requesting the PRF salts during the create ceremony returns the outputs in the same response → no follow-up GET, no race, one prompt.
Fallback. Authenticators that don't evaluate PRF on create return no PRF output; we then derive via a GET ceremony (after a short delay to let the new credential become discoverable). Two prompts, same correctness.
Mirrors signIn, but for a brand-new credential. Unlike sign-in, the caller persists the sigil triple — the create returns the passkey's P-256 pubkey (for KeyAuthorization), which the caller surfaces + stores.
Parameters
Display name for the passkey (host app label).
Throws
if PRF is unavailable on either path.
if the create ceremony fails (cancellation, etc.).