An app can ask the passkey for a secret of its own, derived from the
same credential but separate from the signing key: pass
`appSecret: { label }` and read it with `withAppSecret(callback)`.

- Every PRF ceremony (connect, unlock) also evaluates `eval.second`
  with `@txnlab/use-wallet-passkey:app-secret:v1:<label>` while the
  option is set. The label is 1-128 characters, no `:`.
- The secret is held only while the session is unlocked and zeroed on
  lock, release, a failed connect and a key mismatch. `withAppSecret`
  hands the callback a copy it zeroes afterwards; while locked it runs
  a PRF ceremony (confirmed per `confirm`).
- A provider that returns no second output gives `PasskeyError` code
  `app-secret-unavailable`.
- `PasskeySigningRequest` gains `{ type: 'app-secret' }`.
- `APP_SECRET_PREFIX`, `appSecretInput` and `PasskeyAppSecretOptions`
  are exported; the prefix is frozen.

hay.app uses it to derive a separate ZeroSignal payer account from a
passkey Haystack Login, as it already does from a legacy login's key.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

## [2026.44.0](https://github.com/michaeltchuang/a-day-in-my-bobalife/compare/v2026.43.0...v2026.44.0) (2026-11-09)

### Updates & Maintenance

* bump com.pierfrancescosoffritti.androidyoutubeplayer:core from 13.0.0 to 13.1.0 in /DisneyScenicRides ([#384](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/384)) ([1708a12](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/1708a12e33dc1385a4a45d59d445e730dd03ab41))
* bump gradle-wrapper from 9.8.2 to 9.9.0 in /DisneyScenicRides ([#385](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/385)) ([7d5ed76](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/7d5ed76234287c867182480247214cfba76a50f1))
* bump gradle-wrapper from 9.8.2 to 9.9.0 in /HaveAMagicalDay ([#386](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/386)) ([c8f1745](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/c8f174588d7f5ebd712de82061ab56dbe728bc74))
* log greeting (2026-11-03) ([b0d53c9](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/b0d53c9cc723b9ab30b0ec134b1f676d7d82b680))
* log greeting (2026-11-04) ([0be0270](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/0be0270fbd37c59137c6a1e6b52cfcf1a12eada9))
* log greeting (2026-11-05) ([9ea187e](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/9ea187eb008eb0af36e92b9f88a2f9de080c0e52))
* log greeting (2026-11-06) ([7b10adf](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/7b10adfbb30b08466b10cc6c82b5710eb520cb1f))
* log greeting (2026-11-07) ([21a36a1](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/21a36a10585e9c6870e27f5ba41481e5aa477ad4))
* log greeting (2026-11-08) ([ee948e3](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/ee948e315899ee01c34d53219a003c21c6119f62))
* log greeting (2026-11-09) ([08d0ff2](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/08d0ff2a8f7c7a539b8ea4cf469761b9c1e717f4))