v0.4.0

Breaking changes

• Credentials use the browser's JSON format. RegistrationCredential and AuthenticationCredential now take the output of credential.toJSON() directly: credential_id became raw_id, and the per-ceremony fields moved into a new response field (f252006).
• start_passkey_authentication now returns a Result (c783803).
• PRF types were split: PrfInput is now PrfRegistrationInput, and authentication takes a new PrfAuthenticationInput (c783803).
• Public types are #[non_exhaustive], so code outside the crate can't build them with struct literals or match them without a wildcard arm (39e137c).

Added

• credProtect extension (CTAP 2.1 §12.1): the applied level is stored in StoredPasskey::cred_protect, with optional enforcement at registration and new error CredentialProtectionNotApplied (a61d335, 57029f3).
• minPinLength extension (CTAP 2.1 §12.4): the reported length is stored in StoredPasskey::min_pin_length (319ce98).
• Hints: PublicKeyCredentialHint (SecurityKey, ClientDevice, Hybrid) on both options types (9073e6c).
• Cross-origin iframes: opt in with Passki::with_embedding_origins, which checks topOrigin; new error TopOriginMismatch (1143824).
• PRF evalByCredential: a separate PRF input for each credential; new errors PrfEvalByCredentialUnknownKey and PrfEvalByCredentialWithoutAllowCredentials (c783803).

Other

• Shared helpers for CBOR map lookups and authenticator data parsing, and redundant comments removed (c9d5c41, 6cd7ce0).
• Feature guides moved from the README into docs/, and authenticatorDisplayName removed from the spec checklist (36b044b, 47f0615).