PublicKeyCredentialCreationOptions (registration) + PublicKeyCredentialRequestOptions (authentication) parameters. CREATION OPTIONS: rp (RP ID + name); user (id + name + displayName); challenge (cryptographically random 16+ byte); pubKeyCredParams (algorithm priority list - ES256/EdDSA/RS256); timeout; excludeCredentials (prevent re-registration); authenticatorSelection (authenticatorAttachment platform/cross-platform + requireResidentKey/residentKey + userVerification required/preferred/discouraged + hints); attestation (none/indirect/direct/enterprise); attestationFormats; extensions. REQUEST OPTIONS: challenge; rpId; allowCredentials (optional); userVerification; hints; extensions. ALGORITHM PRIORITIES: ES256 (ECDSA on P-256) + EdDSA (Ed25519) recommended; RS256 acceptable for legacy; AVOID ES384 + RS384 unless required; PREFER public-key algorithm support negotiation through pubKeyCredParams list ordering. SECURITY: challenge MUST be at least 16 random bytes (32 recommended); timeout 30s-5min; rpId MUST be the effective domain of the registration page; resident-key + UV combinations determine passkey + discoverable-credential behaviour.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.